Docs/Getting started/How Bill-y works
How Bill-y works
Bill-y is a pipeline with a hard boundary in the middle: everything sensitive happens on the developer's machine, and only derived metrics cross the network. This page walks the full path.
The six steps
1. Capture. The Bill-y agent runs on each developer machine and reads AI coding session data locally, from the same files the coding tool itself writes. Nothing is intercepted on the network and no proxy is involved. Work done by subagents inside a session is recognized and not double counted.
2. Classify. Each turn of work is classified into a workflow phase (understand, design, build, test, review) by an on-device classifier, inside the developer's own session. When confidence is too low, the turn is labeled other and reported as an abstain rather than being forced into a phase.
3. Redact. Before anything is stored or shipped, the record is reduced to the organization's configured redaction level. At the default level the record contains the phase label, confidence, token counts, timestamps and identifiers. No prompt text, no code, no file names.
4. Ship. The agent spools records locally and delivers them to your Bill-y server over TLS with a pinned certificate and a per-device credential. If the server is unreachable, records wait in the spool and nothing is lost.
5. Govern. The server ingests into an append-only store. Access is mediated by roles and scoped principals, small groups are suppressed below a configurable threshold, and every governed read is audited. The analytics plane is structurally limited to team-level views.
6. Read. Leaders consume the result through the console's management views, a weekly digest, Ask Billy (one question, one governed answer), or the MCP integration inside Claude Code.
The boundary, stated precisely
Security guarantee
Classification runs in the developer's own session. Raw session text never reaches the Bill-y machine service, never reaches the server, and never crosses the network at the default policy. This is an architectural property, not a configuration promise.
What crosses the network at the default redaction level:
| Field group | Contents |
|---|---|
| Attribution | Phase label, phase vector, confidence |
| Volume | Input, output, cache read and cache write token counts |
| Time and identity | Timestamps, session and device identifiers, pseudonymous user id |
| Text | None |
Where it runs
- Agent: on every developer machine, Windows and macOS, mass-deployable with your existing endpoint tooling and invisible to daily work.
- Server: one machine on your own infrastructure, with the console served from the same place. No separate services to operate.
Continue with Phase attribution for the model that makes the numbers meaningful, or Architecture and privacy for the deployment picture and the guarantees.