Security

Your agents' history is yours. Here is how we keep it that way.

Transcripts hold your code, your prompts and your mistakes. These are the steps we take today to protect them, and how to reach us when something looks wrong.

1. Encrypted everywhere

   Every connection uses TLS, and your data is encrypted at rest.

2. One organization, one wall

   Each organization's data is isolated from every other's. Only your organization can read its sessions.

3. A key per machine, revocable on its own

   Each laptop and CI runner signs its uploads with its own key. Revoke one and it stops at once, without touching the rest. Batches from machines we don't know are refused.

4. Short-lived access

   Access tokens expire after a few minutes. Sign-in runs through Clerk, and you can pause the collector or revoke a device from the product at any time.

5. Out of the path of your models

   The collector reads files your agents already write, so it never sits between an agent and its model. Steerz uses your own provider keys. It never holds your prompt longer than the call. If you turn on response caching, matching answers are kept for up to 7 days, scoped to your org.

6. Never used to train anyone else's model

   We don't use your content to train models for other customers or the public. Anything trained on your sessions is trained for your organization and served only to it.

7. Delete means deleted

   Delete a session or close your account and it leaves our production systems within 30 days and our backups within 90. Server logs are kept for up to 90 days.

8. A short list of providers

   Every company that handles your data for us, and what it does, is listed in our privacy policy. We tell you before that list changes in a way that matters.