Privacy and security
A tool that watches AI use on people’s machines has to be easy for a security team to reason about. These are the guarantees the collector is built around.
It can’t intercept
Section titled “It can’t intercept”- No certificate is installed and no TLS is terminated.
- No proxy setting is changed.
- No listening socket is opened.
- It’s never in the path of a request. A connection can’t fail, slow down or change because Shield360 observed it.
Everything the collector reports comes from files AI tools already write, OS tables the system already maintains, and, when policy allows, browser history.
It reads only what it needs
Section titled “It reads only what it needs”- Billing facts only. Claude Code and Codex record on disk whether a session ran on a subscription or an API key. The collector reads that billing type. The same files contain an email address, a full name and an organization name, and the collector’s data structures have nowhere to put them.
- Prompt content isn’t collected by the collector. Usage records carry tokens, model, tool, project and plan. Coding-agent hooks capture prompts only if you enable content capture for them, and endpoint redaction scrubs secrets before anything leaves the machine. See Coding agents: privacy and governance.
- Sensitive signals are off by default. Browsing, network observation and key fingerprints each need an explicit policy setting, and the collector fails closed if it can’t read the policy.
- No character of a key leaves the machine. A key fingerprint is a keyed hash of the part of the key the provider shows (family prefix and last four characters), made with your environment’s guard fingerprint key. See Key fingerprints.
Credentials
Section titled “Credentials”| Credential | Where it lives | Stored by Shield360 as |
|---|---|---|
| Install key | Your MDM or the installer’s environment, used once | SHA-256 hash |
| Collector token | The CLI config file on the machine, owner-only permissions | SHA-256 hash |
Keys Shield360 issues (install keys, API keys, hosted proxy keys and agent tokens) are listed by their type marker and the id of their record, such as s360i_… #k3x9q2ab, never by any of their own characters.
The install key is never accepted as a command-line argument, so it can’t show up in the process table or shell history. Revoking a machine or a key takes effect on the next request.
Tenant isolation
Section titled “Tenant isolation”A machine’s data is written to the tenant its token belongs to. The platform sets database_config_id and collector_id from the authenticated token, never from the payload, so a machine can’t write into another tenant. Every read filters on the tenant, and a query without that predicate is refused.
Local-first by default
Section titled “Local-first by default”Shield360 is self-hostable. With a self-hosted platform, collected data never leaves your infrastructure. Features that could send content to a third party, such as a cloud sensitive-data detector, say so before you enable them and are off until you do.