How Synopt handles data

The authoritative, per-field list lives on the security page and is kept in sync with the code. In summary: the agent sends metadata about AI tool activity: which tool, which model, when, token counts, an estimated API-equivalent cost as reported by the tool's own telemetry, the repository, branch and project, and a secret-detection verdict recorded as a type, severity and field.

It does not send prompt text (storage is off by default and fails closed), the detected secret values themselves (redacted on the device before upload), source code or diffs, or keystrokes, screenshots and browser history. The agent is open source, so this is checkable rather than merely asserted.

Alongside telemetry, Synopt Cloud holds the ordinary account data needed to run a hosted service: the email addresses and roles of dashboard users, organisation settings, and enrollment records for each Mac.

• Synopt Cloud: your organisation is the controller and decides what is collected, who can see it and how long it is kept. Codex Labs Technologies LLP acts as the processor, handling it on your instructions.
• Self-hosted: Codex Labs is not a processor at all. The data never leaves your infrastructure and we have no access to it: there are zero outbound data flows. How self-hosting works.

Synopt Cloud runs on Hetzner in Germany (EU). Telemetry, aggregates and account data are stored there. We do not replicate customer data outside the EU.

We take on EU and UK customers, and hosting in Germany is a deliberate choice rather than an accident of where a server was cheap. Here is the honest position, stated once, so nobody has to infer it:

• Your organisation is the controller. Codex Labs Technologies LLP is the processor for Synopt Cloud, handling data on your instructions.
• Everything is stored in Germany. There is no transfer outside the EU to assess, because there is no transfer.
• A formal Data Processing Agreement is not available during early access. We have not had one drafted yet. If your procurement process requires a signed DPA before you can start, tell us: we would rather say “not yet” now than sign something we haven't had reviewed, and self-hosting removes the question entirely.
• We are not claiming GDPR compliance as a certification, because that is not a thing anyone can self-award. What we can do is describe the system precisely and let your DPO judge it.

This is the complete list. There is one:

• Hetzner Online GmbH - Hosting and storage for Synopt Cloud. Servers are in Germany.

No analytics vendor, no error-reporting service, no CDN sitting in front of your data. If that changes, this list changes in the same release.

Send access, correction, export or deletion requests to support@synopt.dev. Email support@synopt.dev and we will delete your organisation's data within 7 days. It is a manual process today: there is no self-service delete button in the dashboard yet, but the commitment is firm.

If you are an engineer whose activity is being reported and your employer is the controller, we will route your request to them and tell you that we have: we cannot unilaterally delete a customer's records, but we will not ignore you either.

• Retention is configurable per organisation, up to a ceiling set by your plan. The retention job re-checks that ceiling on every run, so the ceiling is what actually applies, not whatever was configured when the setting was last saved.
• During early access, data is kept for 30 days on a rolling basis. If you need a longer window to evaluate, ask us and we will raise it for your org.
• Deleting an organisation removes its telemetry and account records.

• We do not sell customer data, and we do not share it with advertisers or data brokers.
• We do not use customer telemetry to train models, ours or anyone else's.
• We do not read your prompts, because in the default configuration we do not have them.

Privacy, DPA and works-council questions go to support@synopt.dev. If you need a signed agreement before a trial, say so and we will tell you honestly what we can sign today.