Docs/Architecture and trust/Architecture and privacy
Architecture and privacy
Bill-y has two mandatory parts: an agent on each developer machine, and one server on your own infrastructure. Everything else reads from the server through the same governed access layer. This page gives the high-level picture and states the guarantees; the full operational detail ships with the product.
The shape of a deployment
| Component | Where it runs | What it does |
|---|---|---|
| Agent | Every developer machine, Windows and macOS | Measures AI coding work locally and classifies it into phases on the device. |
| Server | One machine on your infrastructure | Receives derived metrics, applies governance, serves the console. |
| Console | Served by your own server | Where leaders read phases, spend, forecasts and reports. |
No SaaS control plane, no vendor endpoint, no telemetry to us. The vendor's runtime access to your deployment is the same as any outsider's: none.
What travels, and what never does
Classification happens on the developer's machine, inside the developer's own session. Before anything is stored or shipped, each record is reduced to your organization's redaction policy.
At the default policy, a record that crosses the network contains: the phase label and confidence, token counts, timestamps, and pseudonymous identifiers. No prompt text, no code, no file names, no repository names.
Security guarantee
Redaction happens on the device, before storage. There is no unredacted copy on any server or in any backup, so no future setting change, breach, or request can expand history that was never recorded.
Visibility levels are set centrally, apply fleet-wide, and only move in the direction of less data going forward. Levels that include any text exist only behind explicit organizational opt-in.
Structural guarantees, not policy promises
The claims above are enforced by architecture, and your reviewers can verify each one:
- Team-level analytics is a database boundary. The analytics layer connects through a role that can only read team-level views. A per-developer query is not forbidden by application code; it is inexpressible at the database permission level.
- History is append-only. The ingest path can add records and never modify or delete them.
- Small groups are suppressed. Aggregates below a configurable group size are withheld everywhere, because small aggregates are individual data in disguise.
- Every governed read is audited. Who read what, in what role, over what scope, with what verdict. Person-level reads, where enabled at all, are always audited.
- Agents only dial out. Nothing connects into developer machines, and there is exactly one listener to secure on your network.
Access, briefly
Access is role-based and scoped: administrators run the fleet but cannot browse usage; leaders read their own scope; auditors read the trail and nothing else; developers see their own data. Organization-wide restriction modes control whether person-level visibility exists at all, and they bind every surface identically.
Want the depth?
The full operational documentation (installation, configuration, transport security mechanics, identity, compliance artifacts) ships with the product and is available to evaluating teams as part of the security pack. See Security and the pack.