Security
Headroom measures what AI coding tools cost a team. Doing that well needs surprisingly little data, so this page is a complete list rather than a summary.
What is never collected
- Prompts. Nothing anyone types.
- Completions. Nothing the model writes back.
- Code. No source, no diffs, no snippets.
- File contents and file paths. Not the names of files, not their contents.
This is enforced rather than promised: any content-bearing field that turns up in a future telemetry version is dropped and counted, and stays dropped until it is explicitly allowed.
What is collected
| Field | Why |
|---|---|
| Token counts, by type and model | The whole basis of the cost figure. |
| Cost estimates reported by the client | Cross-checked against our own figure to catch drift. |
| Session and request counts, durations | Distinguishing a busy seat from an idle one. |
| Lines of code changed, commits, pull requests | Shown to the developer themself and as team totals. Never per-developer to an admin. |
| Tool decisions (accepted or rejected) | Same visibility rules as above. |
| Email address and account identifier | Attributing spend to a seat. Grok CLI does not export email; a personal ingest key is what lands those sessions on the right person. |
| Repository name and branch name | Attributing spend to a project. Names only — never contents. Claude Code honours the attributes the installer sets; Grok CLI currently ignores them, so Grok sessions land as repo untracked. |
A channel label, e.g. laptops or ci | Telling developer machines apart from build agents. |
| Client version, terminal type, organisation id | Support and diagnostics. |
No surveillance
Headroom has no leaderboards and no cross-developer productivity comparison, and it will not gain them. That is a product decision, not a feature we have not got round to.
- A developer cannot retrieve another developer’s per-seat detail. The API refuses it.
- Lines-of-code and tool-decision figures are returned only to the person they belong to, or as a team-wide total. An admin never receives a per-developer breakdown of them.
- Per-seat spend is visible to admins — that is the product — and is framed as cost and capacity, never as output.
The client-reported caveat
Telemetry is produced by each developer’s own machine. Someone who wanted to could turn it off or misreport it. We would rather say so plainly than imply a rigour the architecture does not have: Headroom is cost visibility, not an audit trail.
A session’s repository and branch are captured when it starts. Work that moves to another branch mid-session is still counted against the branch it began on.
Retention and hosting
| Hosted | Self-hosted | |
|---|---|---|
| Raw records | 90 days | Operator’s choice; unlimited by default |
| Daily rollups | ~25 months | Operator’s choice; unlimited by default |
| Free-tier view window | 30 days, one seat | Not applicable |
| Region | London, United Kingdom | Wherever you run it |
| Team deletion | Everything held for that team is purged within 24 hours. | |
Rollups outlive raw records, which is what lets a trend survive after the telemetry behind it has been trimmed. On the hosted free tier, older data is retained but gated — not deleted — until the team upgrades.
Credentials
- Ingest keys are 32 bytes of randomness, stored only as a hash. The value is shown once when it is created and cannot be recovered — if it is lost, mint a new one.
- Revoking a key takes effect immediately, not when a cache happens to expire.
- Dashboard sessions are HttpOnly, Secure cookies backed by server-side storage, so signing out everywhere genuinely ends every session.
- The hosted service has no account passwords — a one-time email link, or Google / Microsoft if the operator has configured them.
Self-hosted and air-gapped
The self-hosted build makes no outbound connection unless you configure one. There is no phone-home and no licence server: licences are verified offline against a key compiled into the binary. Fonts and every other asset are bundled, so the console loads nothing from a CDN.
An expired licence does not stop Headroom working — it ends the entitlement to updates. Exceeding a seat cap shows a banner and, after a grace period, gates new seats in the interface. Neither ever causes telemetry to be dropped.
Questions
If something here is unclear or looks wrong, say so — hello@getheadroom.co. That is a bug in this page.