For security reviewers. This page lists how the guard works, what leaves a computer, and where it goes.
How the guard protects
- It runs on your computer. Every action the agent wants to take is checked there before it runs.
- It fails closed. If the guard crashes, times out or can’t be reached, the action is blocked.
- The agent can’t turn it off. The agent can’t change Antelog’s settings, read its key files, delete its log, stop it or uninstall it. You still can.
- The log is tamper-evident. It is a local SQLite file in
~/.antelog. Each entry stores the fingerprint of the one before it, soantelog verifyshows where an entry was changed or deleted. Antelog has no way to edit or delete entries. - Secrets are removed first. Keys, tokens and passwords that Antelog recognizes are replaced with
[REDACTED]before anything is written to the log or sent. - The AI checks only read. They see the text of the action. They never run commands or look at your systems.
The hosted AI check is different. If it can’t be reached, the action is not blocked for that reason. The rules decide alone, so an action no rule stops is allowed.
What leaves your computer, and when
| What | What is sent | Why | Kept? |
|---|---|---|---|
| Hosted AI check (on by default) | Every action that no rule stops outright (a command, a file read, write, edit or search, or another tool call), plus the text of any script it runs, up to 20,000 characters in all, with secrets removed, and a random install id. Goes to app.antelog.dev, which asks an AI model (Jev) through the Vercel AI Gateway. | A second look at actions no rule knows. | Not by Antelog. Antelog keeps only daily and monthly counts, under a one-way hash of the install id and of the network address. The AI providers handle it under their own terms. |
| Hosted judge (on by default) | Only when something is stopped: the stopped action and any script it runs (up to 12,000 characters), the agent’s session id and the folder it is working in, the name of the rule that stopped it, your latest request in that session (up to 2,000 characters) and the end of the agent’s message just before it, with secrets removed. Goes to app.antelog.dev, which asks Anthropic’s Claude Haiku. Not used if you add your own Anthropic key. | To catch false alarms. | Not by Antelog. Only the same counts. Anthropic handles it under its own terms. |
| Your own AI keys (optional) | An Anthropic key: the same as the hosted judge. A Vercel AI Gateway or Cloudflare key: the same as the hosted AI check. Sent straight from your computer under your own account. | You chose your own key. | Never reaches Antelog. |
| Team dashboard (only if you connect a machine) | The action history: time, session, tool, a summary of the action (its first line, cut short), the decision and the reason, with secrets removed. The log’s tamper check result. A one-way hash of the install id. | So your team sees every machine in one place. | Yes, in the dashboard’s database. The dashboard shows 14 days on Free and 90 days on Pro. |
| Approval requests (connected machines only) | The stopped action in full, with secrets removed, and why it was stopped. | So the agent’s owner can say yes or no. | Yes, in the dashboard’s database. |
| Sign-in | Your email and name. If you sign in with GitHub: that account’s id, profile picture link and sign-in token. Your sign-in sessions, with the network address and browser. Codes are sent by email through Amazon SES. | To sign you in to the dashboard. | Yes. |
| Payments | Card details go to Stripe and never reach Antelog. Stripe Tax adds US sales tax. | To pay for Pro. | Antelog keeps your plan status. Stripe keeps the payment details. |
| Emails | Sign-in codes, invitations and approval emails (the agent name, the reason, the command and a link), sent through Amazon SES. | To reach you. | Approval requests are kept in the database (see above). |
| Slack (only if you connect it) | Approval messages with the agent name, the reason, the command and a link. Only if an admin pastes a Slack incoming-webhook link. | To reach your team faster. | In your Slack workspace. |
| Contact form | Your name, work email, company, team size and message. Emailed to us through Amazon SES. | To reply to you. | Yes, in the dashboard’s database. |
| Website analytics (antelog.dev only) | Page visits and which pages and buttons people use, through Vercel Web Analytics and Google Analytics. Google Analytics sets cookies. The Antelog software sends no analytics. | To see what people use. | By Vercel and Google. |
All traffic uses HTTPS.
How to turn each off
- Hosted AI check and hosted judge: write
offinto~/.antelog/hosted-ai-check, for exampleecho off > ~/.antelog/hosted-ai-check. Then the rules decide alone. If you added your own AI keys, remove them too:anthropic-api-key,ai-gateway-key,cloudflare-tokenandcloudflare-accountin~/.antelog. - Check what is on: run
antelog doctor. - Team dashboard: don’t connect the machine. To stop a connected one, revoke it on the dashboard’s Agents page; it can no longer upload or ask for approvals.
- Slack: an admin clears the Slack link in the dashboard’s Settings.
- Approval emails: an admin turns them off in the dashboard’s Settings.
- Website analytics: for Google Analytics, block cookies in your browser or use Google’s opt-out add-on. Vercel Web Analytics sets no cookies and only counts visits; a content blocker stops it.
Where data is stored
- Your log: on your own computer, in
~/.antelog. - The dashboard and its database: on a Hetzner server in Falkenstein, Germany.
- This website: on Vercel.
Outside services we use
- Hetzner: the server for the dashboard and its database, in Falkenstein, Germany.
- Vercel: hosts this website, and its AI Gateway carries the hosted AI check to the AI model that answers it (Jev). Ask us for the model’s provider.
- Anthropic: Claude Haiku answers the hosted judge.
- Stripe: payments and US sales tax.
- Amazon Web Services (SES): sends emails.
- Cloudflare: DNS, and forwarding for the support@ and hello@ email addresses.
- GitHub: sign-in with GitHub, and the downloads.
- Google Analytics: website analytics on antelog.dev.
- Slack: only if you connect it.
What we never get
- Your code base. We never upload your code base. The AI check sees only the one action it checks: the command and the text of any script it runs, or the new text of a file write or edit. It doesn’t keep it.
- Your secrets. Keys, tokens and passwords Antelog recognizes are removed before anything is sent.
- Your local log, unless you connect the machine to the dashboard. Even then, only the short history above is uploaded.
Report a security issue
Email support@antelog.dev.
Need a security questionnaire or a data processing agreement (DPA)? Contact us.