Security and trust What leaves a machine
What leaves a machine
The oxel agent reports to the API of the deployment it enrolled with. This page lists what it sends and what it does not, and which part of that your workspace controls. Everything between your machines, the console and Oxelone's servers is encrypted in transit.
What never leaves
- The machine's private key. It is generated on the machine when it enrols and is never sent anywhere. The agent signs what it sends with it, and the server takes the workspace from that signed identity: an agent cannot name another workspace.
- A developer's own API key. Under the CLI & IDE tools strategy, the agent asks each tool's hook before the tool acts and answers it. Nothing is re-routed, so the key never leaves the tool.
- Anything the agent has not been asked for. See below.
What is sent
| What | What it contains | Who decides |
|---|---|---|
| Heartbeat | That the machine is alive, including a digest of each scan root. An unchanged digest costs the server one comparison. | Always sent |
| Inventory | For each AI artifact found: its identity, location, type, size, modified time and a content hash. | Always sent |
| AI artifact contents | A file's body, only when a policy filter marked "needs the file's contents" asks for it. The server checks it against the hash it asked for, then keeps a bounded preview, not the whole file. | Your policies |
| AI tool sessions | Session metadata read from an AI tool's session log. The format has no text field, and the server checks every session again before storing it. | Sent when sessions are found |
| Interactions | An intercepted exchange with an AI service: its metadata and, so that policies can decide, its content. | Your policies and your logging mode |
| Policy questions | When a policy needs an engine to decide, such as PII & Secrets, the agent asks the server and sends the content that engine needs. The server runs the engine and answers; it does not log the content. | Your policies |
What your workspace keeps
Content reaching the server is not the same as content being stored. Interaction logging applies once your policies have decided, and it decides what stays:
- Which interactions are kept: all of them, those a policy evaluated, or only matches.
- Whether their content is kept: always, only on a match, or never.
- How sensitive values look where a PII & Secrets policy applied: Permanent, Restricted, Masked or None.
Some capture tactics never collect content at all. The Interaction logging page counts the machines that use one.
The agent does not follow your logging mode; the server does. See Interaction logging for the eight modes and Retention for how long each record is kept before it is deleted.
After it reaches Oxelone
- Your SIEM. Only if you add a destination under Log streaming. Interaction text is off by default and is sent, after redaction, only if you switch on Include content.
- An AI model. Only if your workspace uses an AI judge. With Oxelone's default model, the text the judge checks goes to that model. With your own provider, that provider is yours. Sending artifacts to the judge needs Send artifacts to AI judge, which only the Owner role holds.
- Not sold, not used for training. Oxelone does not sell workspace data and does not use it to train AI models. See Legal.
Machines that are off or cannot reach Oxelone
A scan runs on the machine and does not wait for the network. A machine that stops sending heartbeats is visible as such, whether it was switched off or removed.