Skip to main content
Quint records what AI coding agents do on a machine and uploads that record to your workspace. Some of what it uploads is content: prompt text, the files an agent reads, the output of the commands it runs. This page is for the people who approve a rollout and for the people whose machines are enrolled. Share it freely. The installer shows the full notice before it installs anything, and the notice cannot be switched off. If what it describes is not acceptable for a machine, do not enrol that machine.

​
What is recorded and uploaded

Masking is best-effort. Quint replaces the credentials it recognises, such as an AWS key, a GitHub or Slack token, a private key block or a keyword-assigned API key, with a marker before upload. Anything it does not recognise, including other secrets, customer data and personal messages typed into an agent, is uploaded as written. Do not read “masked” as “no secret leaves this machine”.

​
Four ways capture happens

  1. The agent’s own telemetry. Claude Code, Codex and Gemini CLI report their activity to the endpoint. Quint does not turn on their prompt logging; a prompt reaches Quint this way as its length, not its text, unless you or your organisation turn that logging on.
  2. The intercepting proxy. The agent’s requests to its model provider pass through a local proxy, which reads the request body.
  3. The agent hook. The agents Quint supports run a small hook before each tool call. The hook uploads the commands, paths, working directory, project, repository and OS user name the agent declares. Prompt and response text seen by the hook stays in the local audit database.
  4. The network filter. A system-wide filter sees every outbound connection from every process on the Mac and records destination, port and process. Only connections from a recognised agent session are uploaded; the rest are discarded on the machine. The contents of connections are never read or modified.

​
What turns capture off

The endpoint repairs its own settings in the agents it covers. A setting removed by hand is restored on the service’s next check-in unless you use one of the switches above.

​
Where it goes and how long it stays

  • Data lives in your workspace’s Data region, shown under Settings › General. It is set when the workspace is created and does not move.
  • Your workspace’s data is isolated at the database level. Every query is scoped to your workspace.
  • Retention is per class of data: divergence findings 14 days, events 14 to 45 days, sessions 365 days, and some records with no automatic deletion yet. The full table is under Settings › Data & retention and in Workspace and data.

​
Next