Privacy and security
A tool that watches AI use on people’s machines has to be easy for a security team to reason about. These are the guarantees the collector is built around.
It can’t intercept
Section titled “It can’t intercept”- No certificate is installed and no TLS is terminated.
- No proxy setting is changed.
- No listening socket is opened.
- It’s never in the path of a request. A connection can’t fail, slow down or change because Shield360 observed it.
Everything the collector reports comes from files AI tools already write, OS tables the system already maintains, and, when policy allows, browser history.
It reads only what it needs
Section titled “It reads only what it needs”- Billing facts only. Claude Code and Codex record on disk whether a session ran on a subscription or an API key. The collector reads that billing type. The same files contain an email address, a full name and an organisation name, and the collector’s data structures have nowhere to put them.
- Prompt content isn’t collected by the collector. Usage records carry tokens, model, tool, project and plan. Coding-agent hooks capture prompts only if you enable content capture for them, and endpoint redaction scrubs secrets before anything leaves the machine. See Coding agents: privacy and governance.
- Sensitive signals are off by default. Browsing, network observation and key fingerprints each need an explicit policy setting, and the collector fails closed if it can’t read the policy.
- Keys never leave whole. A key fingerprint is the provider’s own redacted hint shape (
sk-ant-api03-R2D...igAA) and no more.
Credentials
Section titled “Credentials”| Credential | Where it lives | Stored by Shield360 as |
|---|---|---|
| Install key | Your MDM or the installer’s environment, used once | SHA-256 hash |
| Collector token | The CLI config file on the machine, owner-only permissions | SHA-256 hash |
The install key is never accepted as a command-line argument, so it can’t show up in the process table or shell history. Revoking a machine or a key takes effect on the next request.
Tenant isolation
Section titled “Tenant isolation”A machine’s data is written to the tenant its token belongs to. The platform sets database_config_id and collector_id from the authenticated token, never from the payload, so a machine can’t write into another tenant. Every read filters on the tenant, and a query without that predicate is refused.
Local-first by default
Section titled “Local-first by default”Shield360 is self-hostable. With a self-hosted platform, collected data never leaves your infrastructure. Features that could send content to a third party, such as a cloud sensitive-data detector, say so before you enable them and are off until you do.