Security and privacy

AI Code Insights gives engineering organizations visibility into how AI coding agents contribute to software delivery without relying on behavioral monitoring. This page explains what the local daemon collects, what stays on the developer’s machine, what is sent to DX, and which controls are available to admins.

Data flow

System architecture diagram: Download the PDF for a visual overview of data collection, local processing, and transmission to DX.

The daemon loads its API URL and token from local or managed configuration, then periodically fetches repositories and settings from DX. It matches returned repository URLs to local Git remotes, including linked worktrees, and stores matches in repositories.db. Repositories that are not returned by DX are ignored.

Supported AI coding agents invoke the aicodemetricsd hook command for edit and session events. For edit events, the hook resolves the edited file paths, reads each edited file locally up to a 10 MB per-file limit, computes SHA-256 hashes, and sends the hashes plus local before/after bytes to the daemon over local IPC. For session events, the hook records session start context and, when the agent provides it, parses transcript or session data into session messages.

For Claude Code, Codex, Cursor, and Rovo Dev, session parsing also extracts tool-call metadata, including skill and MCP tool identifiers where available. The parser can inspect selected argument fields locally to identify a skill or MCP tool, but does not include raw arguments or outputs in tool-usage records. See Agent integrations for coverage.

The daemon accepts code-attribution events only for agent sessions launched inside monitored repositories, and only for reported file paths inside monitored repositories. Session events can also be accepted from directories configured in additional_session_directories, but those directories do not expand code-attribution scope. It reads edited files reported by eligible hooks and stores local snapshots, insertion and deletion events, line attribution, AI detection blocks, AI-deleted content, commit summaries, commit comparisons, and session-start context in content.db. The daemon compares this local state with committed Git blobs to calculate authorship metrics; source snapshots are not uploaded.

Local databases are stored in ~/.aicodemetrics (macOS/Linux) or $env:LOCALAPPDATA\aicodemetrics (Windows):

repositories.db: Repository metadata (name, Git remote URL, local filesystem path).
content.db: Local attribution data: file-content snapshots for edited files, insertion and deletion events, line-level AI attribution, AI detection blocks, AI-deleted content, Git commit metadata, commit comparison records, aggregate attribution metrics, and session-start context. Source snapshots and detected/deleted code content remain on the developer’s machine.

The daemon polls reflogs, branch refs, and remote-tracking refs for commits, branch changes, and pushes. It analyzes local commits using Git metadata, diffs, committed blobs, and local attribution state, then holds the metrics locally until it confirms that the commit appears on a remote branch. Local commits that cannot be confirmed on a remote are not sent to DX.

The daemon sends data to the DX API over HTTPS:

On push: Commit attribution metrics.
On session update: Session metadata, scrubbed messages, and tool-usage metadata where supported, when an agent emits a stop, compact, or end event. Messages can include code snippets from the conversation.
On installation or status update: Installation and diagnostic status.

See What is collected for the fields included in each payload. Source snapshots, detected or deleted code content, and raw diffs are not sent as commit-analysis payloads.

When Enable auto-updates is on, eligible macOS, Windows, and Linux daemons check the current version through the DX API and download the platform package from the returned release URL. A privileged helper on the machine verifies the package before replacing the daemon binary. The helper restores the previous binary if the updated daemon does not start and confirm the new version within three minutes.

The daemon performs the network requests. The updater helper communicates with the daemon over a local socket or named pipe and does not upload source code, session data, or attribution data.

Linux requires installation through the 0.7.2 or newer Linux installer and a working systemd user manager. See Automatic updates for platform prerequisites.

DX ingests the data into the organization’s data lake, powering reports and Agent Experience scoring. Sensitive session objects are blocked from custom queries by default — see Transcript handling.

What is collected

Category	Data
Repository and scope metadata	Repository name, ID, remote URL, local path, and monitored repository health
Commit metadata	Commit hash, commit message, branch, remote branch, Git author (username and email), and analysis timestamps
System and installation data	System username, hostname or machine name, OS, daemon version, Git email, config status, hook status, and local database paths
Aggregate metrics per commit	Total lines added/deleted with human vs. AI attribution, files changed count, AI retention rate, and total AI percentage
Per-file metrics	File paths, change types, line-level AI attribution counts, AI/human additions and deletions, and total line counts
Line-match metadata	Detection line numbers, committed line numbers, status, and similarity scores for AI-attributed lines. Line text is not included.
Agent attribution	Agent name, version, model, and related AI session IDs for agents with native integrations
Session metadata and messages	Session ID, tool/version/model, start time, title, user email, working directory, token counts where available, and scrubbed message text from supported agents
Tool usage	Session-linked call ID, tool name and type, skill names and optional namespaces, MCP server and tool identifiers, and start/completion timestamps, duration, status, and model where available

Tool-usage records contain metadata only: they omit raw tool arguments, outputs, shell-command text, and skill-file contents. Skill identification from a file path extracts the skill name and optional namespace without transmitting the full path in the tool-usage record. This does not change the separate collection of working directories, attribution file paths, or scrubbed session messages described above.

Category	Details
Source files and raw diffs	Edited file contents may be read and stored locally for attribution, but local source snapshots, AI detection content, deleted code content, and raw Git diffs are not transmitted as commit-analysis payloads. Scrubbed session messages are separate and can include code snippets if those snippets appeared in the AI conversation.
Clipboard contents	Not monitored.
Keystrokes	Not monitored.
Screenshots or screen content	Not captured.
Browsing or application activity	Not monitored.
Files outside monitored repos	Code attribution is limited to repositories whose Git remote origin matches a repository imported through a supported source control connector. Admins can add directories for session collection, but that setting does not expand code attribution.
Time tracking or productivity metrics	AI Code Insights measures code authorship attribution, not developer speed or hours worked.

Responsible use

Use AI Code Insights to improve systems, rollout decisions, and developer-agent workflows. Neither AI code percentage nor Agent Experience measures hours worked, code quality, employee performance, or causal ROI. Prefer team and cohort patterns over standalone individual metrics.

Before rollout, document the purpose of collection, who can access individual and transcript data, how long the pilot will run, and how developers can report incorrect attribution. Inspect the underlying work before acting on an outlier.

Transcript handling

Native agent integrations collect session metadata and can parse eligible messages. The daemon scrubs messages before upload. The Transcripts & Agent Experience admin setting controls downstream storage and evaluation; it does not prevent the daemon from parsing and sending scrubbed messages.

Tool-usage metadata is collected and stored independently of transcript retention. Disabling Transcripts & Agent Experience does not stop tool-usage uploads or storage, including skill and MCP tool identifiers.

Scrubbing: The daemon replaces recognized secrets and personal data with [FILTERED] in session titles and message text before they leave the developer’s machine. Scrubbing reduces exposure but cannot guarantee that every sensitive value or code snippet is detected. Tool-usage metadata, including tool names and skill/MCP identifiers, is not passed through this text scrubber.
Agent Experience: When enabled, DX evaluates the scrubbed transcript with a separate model to produce requirements, steering, and scope ratings. See DX AI data processing for provider, model-training, and retention details.
Access: Configure transcript visibility under Admin → General settings → Access → AI Code Insights transcripts. The setting also covers titles, summaries, and Agent Experience comments. See IC metrics for available scopes. Selecting Nobody does not disable storage or analysis.
Custom queries: Transcript data is blocked from Data Studio and DX AI by default. A separate account-wide control can enable transcript queries independently of report visibility; non-sensitive session metadata and ratings remain available without it.
Stopping collection: Disabling Transcripts & Agent Experience stops downstream retention of message text and transcript evaluation for new session updates. Session metadata and tool-usage records are still stored, and the daemon continues parsing and sending session data. Remove the affected agent integration or uninstall the daemon to stop collection on a machine.

Data lifecycle

Data	Lifecycle
Local attribution events and source snapshots	The daemon keeps rolling working state in its local database. It prunes edit events older than 90 days, pushed-commit working records after 2 days, and abandoned session-start records after 14 days; version and branch cleanup can remove state sooner.
Local configuration, databases, and logs	They remain on the machine until the daemon or its cleanup jobs remove them. The optional cleanup step in Uninstallation removes the remaining local data.
Data already uploaded to DX	Uninstalling the daemon stops that installation from collecting new data, but it does not request deletion of data already stored by DX. Contractual retention, backup, export, and deletion terms govern the server-side data lifecycle. Confirm those terms with your DX account team before rollout.

Network and infrastructure

API endpoints

The daemon communicates with the DX API host over HTTPS. The API token is scoped to the following endpoints and cannot access other DX APIs or data:

Endpoint	Method	Purpose
`/api/aiCode.repos.list`	GET	Fetch the list of repositories to monitor (sourced from Data Cloud)
`/api/aiCode.commits.push`	POST	Send commit analysis metrics on Git push
`/api/aiCode.settings`	GET	Fetch remote daemon settings, including auto-generated file patterns
`/api/aiCodeInsights.currentVersion`	GET	Check the current daemon version and request a platform download URL
`/api/aiCode.sessions.upsert`	POST	Send session metadata, scrubbed messages, and supported tool-usage metadata
`/api/aiCode.daemonInstallation.upsert`	POST	Report daemon version, OS, configuration, and diagnostic status to DX

When automatic updates are enabled, the daemon downloads the platform package from software.getdx.net. The API token is not sent to this host.

If your network uses a firewall or proxy, ensure outbound HTTPS access to your organization’s DX API URL — found under Admin → AI Code Insights — and to software.getdx.net. For the full list of DX hosts and IP addresses, see Adding DX to your allow list.

Release download paths

Every object on software.getdx.net is served under the /ai-code-metrics/ prefix. All requests are unauthenticated HTTPS GET or HEAD:

Path	Requested by	Purpose
`/ai-code-metrics/dx-ai-insights-<version>-darwin.pkg`	Daemon (macOS)	macOS installer package
`/ai-code-metrics/dx-ai-insights-<version>-windows-amd64.msi`	Daemon (Windows)	Windows installer package
`/ai-code-metrics/dx-ai-insights-<version>-linux.tar.gz`	Daemon (Linux)	Linux release archive
`/ai-code-metrics/ai-code-metrics-current-version.txt`	DX, server-side	Plain-text pointer to the currently published version
`/ai-code-metrics/ai_code_metrics_changelog.md`	Docs site build	Published release notes rendered on the changelog page

Developer machines only need the three installer paths. The version pointer is read by DX when it answers /api/aiCodeInsights.currentVersion, not by the daemon; on DX Managed the app runs in your own AWS account, so that request egresses from your infrastructure as well.

Filenames are version-stamped and immutable, so allowlist the prefix rather than individual releases. To verify connectivity end to end, read the current version and then request the matching package:

V=$(curl -s https://software.getdx.net/ai-code-metrics/ai-code-metrics-current-version.txt)
curl -sI "https://software.getdx.net/ai-code-metrics/dx-ai-insights-$V-darwin.pkg"

A path outside the /ai-code-metrics/ prefix returns 403 Access Denied rather than 404 Not Found, because the CDN’s origin storage is private and does not expose a listing. A 403 during a download test is almost always a URL missing the prefix, not a blocked request.

Update verification

DX code-signs the macOS .pkg, Windows .msi, and daemon binaries inside the Linux .tar.gz. Before activating an automatic update, the helper verifies:

macOS: The package has the expected Developer ID Installer identity.
Windows: The MSI has a valid Authenticode signature, the expected publisher, and the expected product metadata.
Linux: The daemon binary has a valid detached signature and a certificate chain to the embedded DigiCert trust root. The signing certificate must identify Atlassian Pty Ltd, be valid, and permit code signing and digital signatures.

For manual deployments, verify the package signature and download every installer from Admin → AI Code Insights.

Tamper resistance

The daemon does not include built-in self-protection against users stopping the process or modifying configuration. Organizations that need to limit developer interference should use endpoint-management controls for configuration-file permissions and service persistence. If a user deletes the local SQLite databases, the daemon recreates them on its next run. Previously uploaded metrics remain in DX, but unuploaded attribution state can be lost.

Credential lifecycle

The daemon uses one organization-wide token scoped to AI Code Insights endpoints. Treat it as a bearer secret: store it in your endpoint-management system, restrict who can read managed profiles or registry values, and do not place it in source control or a shared script.

On macOS and Linux, the daemon restricts its local data directory to the current user and writes the config file with mode 0600.
On Windows, the user config inherits the current user’s profile ACL. An MDM-delivered token in HKLM\SOFTWARE\GetDX\AICodeMetrics can be stored as plaintext, so restrict registry access through your endpoint policy.
The CLI masks existing tokens and does not print them in status output or include the config file in diagnostic reports. Review diagnostic bundles before sharing them.

Regenerating the token immediately invalidates the previous token; there is no overlap window. To rotate it:

Prepare an updated managed configuration or deployment job without distributing it.
Schedule a maintenance window because existing daemons cannot upload after regeneration.
Select Regenerate API token under Admin → AI Code Insights.
Insert the new token into the prepared configuration and deploy it to every target machine.
restart the daemon and check its status on each representative deployment path.
Monitor client versions to find machines that did not receive the new credential.

Uninstall the daemon and remove local data when a user or machine leaves scope. Rotate the organization token when you suspect it was exposed or when an offboarded user could retain an unmanaged copy.

Endpoint considerations

The daemon’s behavior — a background process that hooks into developer tools, stores data locally, and makes outbound HTTPS calls — can trigger alerts in EDR, antivirus, and other endpoint-security tools. Pre-configure exclusions before rolling out to developer machines.

Processes to allow: /usr/local/bin/aicodemetricsd and /Library/Application Support/AI Code Metrics/aicodemetricsd-updater
Paths to exclude from real-time scanning: ~/.aicodemetrics/ and ~/Library/Logs/AI Code Metrics/
Services: The daemon runs as a per-user LaunchAgent. The updater helper runs as a root system LaunchDaemon.
Access: Read access to monitored repositories and outbound HTTPS to the DX API.

Grant Full Disk Access only when monitored repositories can live under Desktop, Documents, Downloads, or another protected directory. For PPPC policies, use the identifier com.getdx.aicodemetrics. See Installation for details.

Processes to allow: %ProgramFiles%\AICodeMetrics\aicodemetricsd.exe and %ProgramFiles%\AICodeMetrics\aicodemetricsd-updater.exe
Path to exclude from real-time scanning: %LOCALAPPDATA%\aicodemetrics\
Services: Scheduled Task \AICodeMetrics runs under LeastPrivilege in the user’s interactive session. The on-demand updater task \AICodeMetricsUpdater runs as LocalSystem.
Access: Read access to monitored repositories and outbound HTTPS to the DX API.

Processes to allow: /usr/local/bin/aicodemetricsd and /usr/local/lib/aicodemetrics/aicodemetricsd-updater
Path to exclude from real-time scanning: ~/.aicodemetrics/
Services: The daemon runs as a systemd user service. The updater helper runs as a root systemd system service.
Access: Read access to monitored repositories and outbound HTTPS to the DX API.

The daemon downloads release packages when automatic updates are enabled. The updater helper only accepts local requests from authorized daemon users and does not require network access.

The daemon writes frequently to its local SQLite databases. Exclude the listed data paths from real-time scanning to prevent EDR tools from locking these files and degrading collection.

Resource usage

Resource	Typical usage
Memory	~100 MB (varies with the number of monitored repositories)
Disk	Up to a few GB for local SQLite databases
CPU	Minimal — driven by agent hook events and lightweight Git polling
Network	Small HTTPS payloads for polling and uploads, plus occasional platform-package downloads when automatic updates are enabled

Note: Resource usage can be higher for very large monorepos, and attribution may be less accurate. Include representative repositories in the evaluation, deploy to a small cohort, monitor machine performance, and validate known commits before expanding.

Source code access

DX offers source code review of the AI Code Insights daemon for qualifying enterprise customers. Contact your DX account team or reach out via Slack to request access.

Compliance

DX maintains SOC 2 Type II compliance. For data processing agreements, data residency details, and additional compliance documentation, contact your DX account team.

Some jurisdictions require works council consultation before deployment. AI Code Insights measures code authorship in designated repositories; it does not monitor developer behavior, communications, browsing, or non-development activity. Use this collection scope with your legal team to determine local requirements.