Can you keep AI coding tool usage data on your own servers?

What has to be true for the data to genuinely stay yours

On-prem is a label, and plenty of products wear it while still talking to their vendor. Before you accept any answer, including ours, work through this list with the vendor's engineer rather than their account manager.

• Does the backend make any outbound connection at all, ever? Not "is telemetry off by default", but is there any code path that opens a socket to the vendor.
• Is there a licence check? A licence server is an outbound connection with a business reason attached, and it is the most common reason an air-gapped deployment fails on day one.
• Does it check for updates against the vendor? If it does, that is a connection and a fingerprint.
• Where does the endpoint agent send data, and can that be pointed at a hostname you control? If the agent has a vendor domain compiled into it, nothing else on the list matters.
• Does the dashboard authenticate against anything of the vendor's, or is identity entirely yours?
• Will it run with egress blocked at the firewall? That is the test, and the answer is either yes or the deployment is not what you were sold.

How to verify it rather than believe it

All four of these are cheap, and any vendor who resists them has told you something.

• Block outbound traffic from the container's network and run it for a week. Nothing should degrade.
• Watch egress the boring way, with netstat, firewall logs or a network policy, and look at what actually opens.
• Read the agent's source, if it has any. The component running on an engineer's laptop is the one your security team will ask about, and reading it is the only answer that does not require trusting anyone.
• Try an air-gapped install. Not as a proof of concept, as a test: if the install path assumes a registry pull from the internet, you have found the dependency.

The route with no vendor at all

Worth putting first, because for some teams it is the correct answer and nobody will tell them so. Claude Code and Codex CLI both export OpenTelemetry to an endpoint you nominate. If you already run a collector and a metrics store, you can have Claude Code usage flowing into infrastructure you own by the end of the afternoon, with no third party involved and nothing to procure.

That is the maximal version of keeping data on your own servers, and it costs nothing but time. What you take on is the config distribution to every machine, a second and third integration for the tools that do not speak OTel the same way, the storage and cardinality decisions, and the dashboards. If your platform team already exists and has capacity, that is a good trade.

What Synopt self-hosted actually is

Three containers via Docker Compose, plus one agent per Mac. That is the whole operational footprint: no message broker, no cache server, no separate worker.

Against the checklist above: no phone-home, no vendor telemetry, no update check against us, and no licence check of any kind, because there is no licensing code in the backend to check anything. Agent updates are served by your own backend or your MDM. It runs air-gapped, and you can verify that by watching the container's egress rather than by trusting this paragraph.

Agent to backend traffic is HTTPS over your internal network, authenticated with a per-agent bearer token that is stored only as a hash.

EU hosting and self-hosting are different questions

These get conflated constantly, usually by someone trying to sell one as the other. Synopt Cloud runs on Hetzner in Germany, inside the EU, so an EU customer does not need to self-host to keep data in the EU. Self-hosting is the answer to a stricter requirement: telemetry may not leave our network at all, or we cannot accept a processor relationship with a vendor this early.

Those are different constraints with different owners. Work out which one you actually have before you take on the operational cost of the stronger answer.

What you give up by self-hosting

• It is not self-serve. There is no self-hosted signup and no public download of the backend: it is sold with a support agreement, and that is stated up front rather than discovered at the end of a trial.
• You own the operations. Upgrades, backups, Postgres, TLS, uptime and the retention job are yours.
• The backend and dashboard are not open source. The agent is, under Apache-2.0, and it is the only component that runs on an employee's machine. If your evaluation requires source access to the backend, raise it early.
• You serve agent updates. No vendor update channel means no vendor dependency, and it also means the distribution is your job.

What self-hosting does not change

The limits travel with the product. Self-hosted or hosted, the agent is macOS only, so Windows and Linux engineers are not covered. There is no alerting of any kind in either deployment: findings appear in the dashboard and nothing notifies you. There is no SSO or SAML. Synopt has never been SOC 2 audited or penetration tested, and running it on your own hardware does not change that, it only changes who the audit would be about.

Capture is the same three tools in both cases: Claude Code, Codex CLI and Cursor IDE. Not Cursor CLI, not GitHub Copilot, not ChatGPT.