What Synopt collects, and what it deliberately cannot

The agent reads telemetry that AI coding tools already emit locally, normalises it, and ships metadata. It does not read your codebase and it does not sit between you and your model provider.

Secret detection runs inside the agent, on the engineer's Mac, at capture time: before anything is written to the upload buffer. When the scanner matches a credential, it records the finding's type, its severity and which field it appeared in. It does not record the matched substring. The value is gone before the event exists in a form that could be uploaded.

This is detection and redaction, not prevention. Synopt does not sit in the request path and cannot block a prompt from reaching a model provider. If an engineer pastes an AWS key into Claude Code, that key still goes to Anthropic. What Synopt gives you is the knowledge that it happened, on which machine, in which repo, without also handing us the key. Anyone who tells you an endpoint agent of this shape prevents the leak is describing a different product.

Prompt text is not stored. That is the default, and the default is enforced by failing closed: if the setting is absent, empty, malformed, or mistyped, it resolves to storing nothing. There is no configuration mistake that silently turns prompt capture on.

An organisation that wants prompt content (some do, for incident review) has to turn it on explicitly for itself. Be clear-eyed about what that means: it is an org setting an admin can change, not something we gate on a conversation. If prompt storage is on, prompt text is stored, and the “never collected” column above stops applying to that one row. Nothing about a typo can turn it on, but an admin decision can.

• Synopt Cloud runs on EU infrastructure in Germany (EU). Telemetry, accounts and aggregates are stored there and nowhere else.
• Self-hosted keeps everything on your own hardware. There are zero outbound data flows: no phone-home, no vendor telemetry and no update check. (There is no licensing code in the backend either, so there is nothing to validate, locally or over the network.) It can run fully air-gapped. How self-hosting works.

• Agent-to-backend traffic is HTTPS with TLS 1.2 or higher, and that is what every documented install uses. Be aware of one sharp edge we have not closed: if you point an agent at a plain http endpoint during enrollment, it prints a warning and continues rather than refusing. Making it fatal is on our list.
• Each agent authenticates with its own bearer token. Tokens are stored in the database only as hashes: a database dump does not yield a working credential.
• The dashboard uses short-lived signed sessions rather than long-lived cookies.
• When the backend is unreachable, the agent buffers events locally in SQLite and uploads them when the connection returns, without retrying in a tight loop. One honest caveat: if the server answers 2xx with a body the agent cannot parse, it treats that batch as delivered. A broken proxy that returns 200 for everything can therefore drop events.

Enrollment is blocked until the person using the Mac acknowledges a disclosure describing what the agent collects. Not a checkbox an admin ticks on their behalf: the agent will not begin reporting until the acknowledgement is recorded on that machine. If the disclosure text changes, its version is bumped and every device has to acknowledge again before it resumes.

This is an unusual thing for a monitoring product to do, and it is a deliberate trade: it makes rollout slower and it makes silent deployment impossible. We think a tool that watches engineers should not be installable behind their backs, and in works-council jurisdictions this gate is often the difference between a deployment that is allowed and one that is not.

The agent supports macOS. Windows and Linux endpoints are not supported, and there is no beta.

The reason is structural rather than a matter of effort. The agent works by reading the AI tools' own local configuration and telemetry files, which live in the signed-in user's home directory. On Windows, the natural install shape for fleet software is a service running in a machine-level account, and that context cannot read those per-user files. A Windows build would install cleanly, report healthy, and collect nothing, which is worse than not shipping it. Solving it properly means a per-user agent with its own lifecycle, and we have not built that yet.

We would rather tell you than let you assume. Synopt has no compliance certification of any kind:

What we can offer instead of a certificate is the source. The agent (the only component that runs inside your network on an employee's machine) is public under Apache-2.0. Your security team can read it, build it, diff it against the binary we ship, and tell us what they find: github.com/Codex-Labs-Tech/synopt-agent.

Security questions, review requests and vulnerability reports go to support@synopt.dev. A human reads it, and we will tell you honestly if the answer is “not yet”.