The same standard we hold your agent to, we hold to ourselves.

The prime directive is that your source code never leaves your machine. Redaction happens at source, in the capture client, before anything is transmitted. The ingest gateway re-applies the same rules as defense-in-depth. Per captured event, only these structured fields cross the wire:

• Tool & outcome: the tool name (e.g. Bash, Edit), the file path only, exit_code, and a failed flag.
• Command head: program + subcommand only (git commit, npm test). All trailing arguments are masked to [redacted].
• Result tail: a length-capped, secret-scrubbed tail of command/read output — dropped entirely for secret-bearing files (.env*, *.pem, *.key, *credentials*, SSH/AWS paths) and scrubbed against a reviewable denylist (URLs with inline credentials, key-shaped tokens, AWS keys, JWTs, Bearer headers, PEM blocks). Set AGENTWATCH_NO_OUTPUT=1 to drop it entirely.
• Text: the user’s prompt and the agent’s final summary (the “claims” we diff against).
• Identity & routing: session id, the agent vendor, a hashed machine id, and — optionally — your user email.

Never transmitted: file bodies (Edit/Write content is SHA-256 hashed to a marker, never sent); diffs, patches, and old_string/new_string; Bash arguments past the command head. Only the enumerated fields above are ever serialized — there is no passthrough of arbitrary tool input or tool response.

Without an API key the capture client is a silent no-op and transmits nothing. AGENTWATCH_DISABLE=1 is a hard kill switch independent of login state.

We keep captured session records only as long as your plan’s retention window, then delete them:

• OSS Local: nothing is sent to us — records live only on your machine.
• Free Cloud: 30 days.
• Team: 90 days.
• Business: 1 year.
• Enterprise: custom, by contract.

After the window, records are purged from primary storage. Account and billing records are kept for as long as your account is active and for the period required to meet our legal and tax obligations.

You can delete captured session data at any time. Deleting an organization removes its session records. To request deletion of an account, an organization, or specific data — and to exercise access, correction, or export rights — email security@agentwatch.run. We action verified deletion requests within 30 days and confirm when complete.

API keys are org-scoped and individually revocable. Revoke a key from the dashboard or run agentwatch logout to stop capture immediately. If a key was pasted into a transcript, rotate it.

Hosted session data is stored and processed in AWS us-east-1 (United States). Enterprise customers can arrange alternative residency or full self-host / on-prem deployment under a custom contract. If you choose OSS Local, no data leaves your machine and there is no residency question at all.

We use a small, named set of sub-processors. Each receives only the data it needs to provide its function:

• Amazon Web Services (AWS) — hosting, storage, and compute (us-east-1).
• Clerk — authentication and user/session management.
• Anthropic — only if you enable the optional LLM judge. The judge sends the captured actions + prompt for a session to Anthropic to grade a verdict. It never sends your source code. This is opt-in and off by default.

We will update this list before adding a new sub-processor that handles your data.

Privacy and security questions, data requests, and vulnerability reports: security@agentwatch.run. Enterprise and contractual questions: sales@agentwatch.run.

See also our Terms of Service and the public source repository.