Audit and data

LetKite records every tool call, so you can see what an AI did on your machines. It does not receive your conversation with the AI, and it keeps the record short and to the point.

What is recorded

Each tool call, allowed or refused, becomes one audit record with:

• the time, the tool, and the machine;
• who: the person, the AI client, and the connection;
• what was asked, in short: for a command, the command line, its exit code, how long it took and the rule it matched; for a file, the path and size; for a terminal, the first 200 characters typed;
• the approval, if one was needed, and the reason when a call was refused.

What is not recorded

• Your conversation with the AI. LetKite only receives tool calls; prompts and replies stay between you and your AI provider.
• Command output and file contents. They go back to the AI client and are not kept in the audit log. (Scheduled tasks keep the last 64 KB of output of each run, shown with the schedule.)
• Screen contents and text typed on a screen.
• Answers typed into a program's prompt through the console, such as a password: only their length.
• Values of secret environment variables.

Secrets in output

On the Business plan, values of secret environment variables are replaced by *** in everything tools return to the AI, including error messages, and in their base64 form. Text you type into a program's password prompt through the console is masked the same way in output for the next 10 minutes. Masking is not encryption: a command written to print a secret another way can still reveal it, which is what command rules and approvals are for.

How long records are kept

Older records are deleted every hour.

Seeing and exporting the log

• In the console, under Audit log: filter by time, machine, member, AI client, event and text. People with the audit permission, and owners and admins, can see it.
• Export as CSV or JSON Lines from the same page.
• From an AI client with fleet.admin, the audit_tail tool returns recent records (up to 500).
• Owners and admins can download a copy of all the account's data.

When LetKite support needs to look at an account's command history, a second staff member must approve it, and the access appears in that account's audit log as LetKite support.

Privacy policy

How LetKite handles personal information is set out in the privacy policy.