> ## Documentation Index > Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt > Use this file to discover all available pages before exploring further. # What Quint records > What leaves a developer's machine, what is masked, how long it is kept, and what turns each part off. Read this before you install anything. Quint records what AI coding agents do on a machine and uploads that record to your workspace. Some of what it uploads is content: prompt text, the files an agent reads, the output of the commands it runs. This page is for the people who approve a rollout and for the people whose machines are enrolled. Share it freely. The installer shows the full notice before it installs anything, and the notice cannot be switched off. If what it describes is not acceptable for a machine, do not enrol that machine. ## What is recorded and uploaded | What | Uploaded to your workspace | Masked first | | - | - | - | | The text of prompts sent to an agent, and the conversation so far, including project instruction files and injected context | Yes, up to 256 KB per turn; replies up to 32 KB | Recognised credentials only | | The contents of files the agent reads | Yes | Recognised credentials only | | The output of commands the agent runs | Yes | Recognised credentials only | | The commands, file paths, working directory, project and repository an agent declares | Yes | Recognised credentials only. In a command, a password passed as a flag, in an environment variable or in a URL is also masked, even with masking turned off | | The OS user name an agent declares | Yes | No | | The email address of the account signed in to the agent | Yes, through the agent's own telemetry | No | | Outbound network connections: destination host name, IP, port and the process that opened them | Only connections from a recognised agent session. Connections from other programs are recorded on the machine and discarded there. Contents are never read. | Not applicable | | The local audit database on the machine | No. It stays on the machine and keeps the unmasked original. | No | **Masking is best-effort.** Quint replaces the credentials it recognises, such as an AWS key, a GitHub or Slack token, a private key block or a keyword-assigned API key, with a marker before upload. Anything it does not recognise, including other secrets, customer data and personal messages typed into an agent, is uploaded as written. Do not read "masked" as "no secret leaves this machine". ## Four ways capture happens 1. **The agent's own telemetry.** Claude Code, Codex and Gemini CLI report their activity to the endpoint. Quint does not turn on their prompt logging; a prompt reaches Quint this way as its length, not its text, unless you or your organisation turn that logging on. 2. **The intercepting proxy.** The agent's requests to its model provider pass through a local proxy, which reads the request body. 3. **The agent hook.** The agents Quint supports run a small hook before each tool call. The hook uploads the commands, paths, working directory, project, repository and OS user name the agent declares. Prompt and response text seen by the hook stays in the local audit database. 4. **The network filter.** A system-wide filter sees every outbound connection from every process on the Mac and records destination, port and process. Only connections from a recognised agent session are uploaded; the rest are discarded on the machine. The contents of connections are never read or modified. ## What turns capture off | Switch | Effect | | - | - | | Policy `log_bodies: false`, set in your workspace | Stops content upload from the proxy and the agent's telemetry, and replaces the hook's uploaded commands, paths, directories and repository with a marker. The local audit database still keeps content. | | Policy `mask_secrets: false` | Turns masking off, except in the commands an agent declares: passwords and recognised tokens in them are still masked. It is on by default. | | Removing the endpoint | Removes the endpoint and Quint's settings from the coding agents on the machine. See [Remove a machine](https://docs.quintai.dev/install/remove-a-machine.md). | | Not enrolling the machine | Nothing is recorded. | The endpoint repairs its own settings in the agents it covers. A setting removed by hand is restored on the service's next check-in unless you use one of the switches above. ## Where it goes and how long it stays * Data lives in your workspace's **Data region**, shown under **Settings › General**. It is set when the workspace is created and does not move. * Your workspace's data is isolated at the database level. Every query is scoped to your workspace. * Retention is per class of data: divergence findings 14 days, events 14 to 45 days, sessions 365 days, and some records with no automatic deletion yet. The full table is under **Settings › Data & retention** and in [Workspace and data](https://docs.quintai.dev/settings/workspace-and-data.md). ## Next * [Quint is on my machine](https://docs.quintai.dev/install/quint-is-on-my-machine.md), written for developers. * [Quickstart](https://docs.quintai.dev/quickstart.md) to enrol the first machine. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.