Trust: metadata only
AIM is a security product. It is not a prompt logger. There is no supported path that sends prompt text or tool arguments off the box.
Personal-mode network claim
aim personal binds 127.0.0.1 only and makes zero outbound network calls. No ingest URL, no analytics beacon, no update check. Verify with networking off.
The fleet path (aim join <ingest-url>) is opt-in and talks only to your ingest. It still sends metadata-only events.
What we collect, and why
| Class | Justification | Access |
|---|---|---|
| Tool / model / provider | Which AI tools are in use; unapproved-tool detection | Analyst dashboard; team aggregates |
| Token counts, cost, timestamps | Volume, cost, anomaly signals (counts, not content) | Analyst dashboard |
Pseudonymous user_ref / host_ref / repo_ref | Correlate usage for alerting without names on the wire. Salted HMAC computed on the endpoint | Dashboards show pseudonyms. Re-identification is security-role-only and audited |
| Detector name + boolean flags | Prove a secret/PII pattern matched without storing the match | Findings; security role |
MCP server name + scope | Inventory configured capabilities so unapproved servers are visible | MCP inventory; policy allowlist match |
| Enforcement decision metadata | Audit what the endpoint did, not what it saw | Findings / usage events |
What we never collect
- Prompt text, response text, file contents, code snippets
- Tool-call arguments, command lines, URLs, env values
- Emails, names, raw hostnames, IP addresses
- Keystrokes, screen content, idle time, non-AI-tool activity
Detectors run in memory at the collection point. Matched content is discarded immediately.
Retention (enforced)
| Data class | Default window |
|---|---|
| Usage events | 90 days |
| Findings | 365 days |
| Audit trail | 730 days |
Ordering audit ≥ findings ≥ events is enforced. A violating config fails closed. Personal mode prunes local SQLite on the same windows. There is currently no legal-hold exemption.
Access control
- Dashboards show pseudonyms or team aggregates. They cannot resolve a person.
- Re-identification is a security-role-only, fully audited lookup.
- The company salt is in the platform KMS / secrets manager, security-role IAM only.
- CSV export of findings excludes evidence payloads.
- Personal mode: one implicit local user, loopback only, no accounts.
Honest residual
Metadata-only does not mean nothing personal can be inferred. Tool names, MCP server names, and small-team patterns can still describe activity. Mitigations are access control and aggregate suppression, not prompt capture.
Enforcement is not fleet-wide. See the enforcement capability matrix (markdown). Longer form: trust.md, data minimization.