Skip to content
ALIGN

What is captured, and who sees it

Where capture happens

Only in repositories your organisation connected and you opted in to, on the laptop where you ran align init. Personal repositories never report. align off stops capture at once; align status shows what is captured here.

From agent sessions

Everything that could leave the machine passes the redaction engine first: transcripts, commit messages, and every argument of align decide, align ask and the MCP tools. File contents never leave, including anything the agent read or wrote through tools: transcripts carry the user's and the agent's words only, fenced code blocks become ‹code: N lines›, and every tool call becomes ‹tool: <name>, <bytes> bytes› plus the repository-relative paths it touched. Tool outputs, diffs from your laptop and the shell commands tools run are never captured. Text you paste without a code fence is sent after secret redaction. The server redacts everything again, including GitHub, Slack and Linear text, before it stores it or sends it to a model.

In detail:

  • Kept: the text of your messages and the agent's replies. Fenced code blocks become ‹code: N lines›; text you paste without a code fence is kept, after secret redaction.
  • Replaced: every tool call becomes one line, ‹tool: name, N bytes›, plus the repository-relative paths of file tools. Tool results, thinking, images and attached documents are dropped.
  • With each event: the agent's name and version, the session id, the branch, the head commit, the repository remote and root commit, the working directory relative to the repository, and a salted hash of your machine name.

From commits

The two git hooks send, for your own commits in an opted-in repository: the commit id, its message (up to 4,000 characters), the names of the changed files and its trailers. No diff is sent. align verify runs your checks locally and sends only paths, line numbers and results.

From pull requests

Nothing from your laptop. With the GitHub App installed, our server reads from GitHub a pull request's title and description, its commits' messages, changed file names and trailers (these are stored, as the commits your git hooks send are), and its changed lines, to check them against your confirmed decisions. Only the hunks under a decision's paths (and, for a Linear contract, the test files' hunks) go to the model that judges them, after secret redaction; the changed lines are processed in memory and not stored.

Redaction on your laptop

Before anything is stored or sent, the CLI removes:

  • Secrets: API keys and tokens of common providers, private keys, JWTs, Authorization, Bearer and Cookie values, credentials in URLs and command-line flags, and long high-entropy strings, replaced by ‹secret›. KEY=value lines whose name looks secret keep the name only. .env files are never read.
  • Email addresses outside your organisation's email domains (‹email›); until the CLI knows those domains, every address. Phone numbers (‹phone›) and IP addresses (‹ip›).
  • Your identity: your home folder becomes ~, your machine's host names become ‹host› and your user name ‹user›. Paths outside the repository are dropped.

The server runs redaction again on every event it receives, and refuses events from a CLI whose redaction is out of date.

Deny files

To keep paths out entirely, list globs in a .aligndeny file at the repository root (committed, for everyone) or in your personal deny file under ~/.align. One glob per line, .gitignore style; # starts a comment. A deny list only adds: lines starting with ! are ignored. Matching paths are removed from tool lines and commits. Common secret files (keys, credentials, .env*, shell histories and more) are always denied.

Who sees what

  • Your raw transcripts: only you. Not your teammates, not owners: the console's Sessions page shows each person their own.
  • Proposals from your sessions: only you, until you confirm or share one, or it appears in a pull request you opened. Other people's proposals in a PR are counted, never shown.
  • Confirmed decisions: everyone who can read the repository, with the short quotes that support them. Members read the repositories they have access to; owners and admins read all of them.
  • Restricted receipts (for example from a private Slack channel) are shown only to the people who could read the source; others see that a receipt is hidden.
  • No per-developer metrics, anywhere: not in the product, analytics, logs or exports. The weekly digest counts per repository, and shows activity numbers only when three or more developers use ALIGN there.

How long data is kept

  • Transcript lines and raw events: 90 days, unless a receipt cites them.
  • Decisions, their revisions and receipts: until you delete them.
  • Export files: deleted after 1 day (removed within 2 days at most).

See Deleting and exporting, and the security and privacy pages.