Data transparency
Exactly what Lineman sends, field by field
Most vendors answer this question with a paragraph about how much they value your trust. Below is the actual list instead. Every field the plugin transmits, every event that triggers a transmission, and the settings that switch each one off.
Lineman has two halves, and they are independent. The Cost Explorer tells you what your coding agents are costing you, and never reads your code. The Compressor saves you tokens by having a cheaper model read things so your expensive model does not have to, which means it does send content. You can run the first without the second.
1. The Cost Explorer
The Cost Explorer reads the usage log your coding agent already writes to your own disk, adds up the tokens, and sends the totals. It opens no source files, and it has no ability to. It does not send prompts, replies, code, file contents or file paths. What follows is the complete record, every field of it. There are no others.
| Field | What it is | Example value |
|---|---|---|
| input_tokens | Tokens your coding agent sent to Anthropic in this 15-minute window. | 1204 |
| output_tokens | Tokens Anthropic generated back. | 883 |
| cache_read_tokens | Tokens served from Anthropic's prompt cache. | 184320 |
| cache_creation_tokens | Tokens written into the 5-minute prompt cache. | 0 |
| cache_creation_1h_tokens | Tokens written into the 1-hour prompt cache. | 41022 |
| web_search_requests | A count of web searches your agent ran. Not the queries themselves. | 2 |
| cost_usd_micro | The cost we calculated for the window, in millionths of a dollar. | 1975431 |
| model | Which Anthropic model produced the tokens. | claude-opus-4-6 |
| ts_bucket_15m | The 15-minute bucket the usage falls into. Not per-keystroke timing. | 2026-07-14T09:15:00Z |
| repo | The repository the work happened in, taken from your git origin remote. Sent in the clear, because per-repository cost attribution is the point of the feature. | github.com/acme/payments |
| branch | The git branch name. Sent in the clear, for per-branch attribution. | feat/LIN-2950-checkout |
| commit | The commit SHA that was checked out. The SHA only, never the diff or the code. | 334e3886e9c1... |
| ticket_id | An issue key, if your branch name contains one. Derived from the branch, nothing else. | LIN-2950 |
| session_id | The opaque session identifier your coding agent already generated. | bb354aef-a8b2-47f1... |
| account_id | A one-way SHA-256 hash of your coding-agent account id. We never receive the underlying id or email. | 3ac91be0f7d21b48 |
| org_id | A one-way SHA-256 hash of your coding-agent organisation id. | 7d0e1c9a4b6f2233 |
| billing_mode | Whether the agent billed a subscription or a pay-as-you-go API key. | subscription |
| plan_type | The plan tier reported by your coding agent, used to price the tokens correctly. | claude_max |
| rate_limit_tier | The rate-limit tier reported by your coding agent. | default_claude_max_20x |
| extra_usage | Whether extra-usage billing is enabled on the account. | true |
| source | Whether the tokens came from the main agent or one of its subagents. | subagent |
| speed | Whether the window ran entirely in fast mode. | null |
| idempotency_key | A hash of the fields above, so a retry cannot double-count your spend. | 9f2c1ab7de40c115 |
The one thing worth reading twice
Three of those fields are not hashed: repo, branch and commit. Your repository name and branch names arrive in the clear. That is deliberate, and it is unavoidable: a dashboard cannot tell you that the payments service cost you four times what the marketing site did unless it knows which one is which. The commit SHA is a pointer, never a diff. No code travels with any of it. If you would rather share none of it, talk to us and we will turn cost reporting off for your account.
2. The Compressor
The Compressor is the half that saves you money on tokens, and it does so by giving content to a second, cheaper model to read. It is worth being blunt about what that means: when Lineman compresses a file, that file is sent, in full and verbatim, exactly as it sits on your disk. There is no way to summarise a file without reading it.
What makes this tolerable for a security-conscious team is that the trigger list is short, explicit, and mostly local. A great deal of what Lineman does never leaves your machine at all. Here is every case.
| When it happens | What leaves your machine | Classification |
|---|---|---|
| Reading a source-code file | Nothing. Lineman parses the file on your machine with a local syntax parser and builds the outline itself. No network call is made. | Nothing sent |
| Reading a small file (under 2 KB, or 50 lines or fewer) | Nothing. It is returned to your agent verbatim from local disk. | Nothing sent |
| Reading a file the local parser cannot outline (prose, Markdown, config, an unsupported language) | The entire file, in full and verbatim, exactly as it sits on your disk. Anything inside that file goes with it, including comments and any configuration values it happens to contain. | Your content |
| Reading a file to answer a specific question | The entire file, in full and verbatim, with line numbers, plus the question being asked of it. | Your content |
| Running a shell command whose output exceeds 2 KB | The raw command output, truncated to 100 KB, together with the full text of the command that was run. | Your content |
| A search that returns 20 or more matches | The matching lines only, truncated to 50 KB, together with the search pattern. Non-matching lines and unmatched files never leave the machine. The search itself runs locally. | Your content |
| Compacting a long session (Smart Compaction) | A window of the conversation itself, which can include your prompts, the assistant's replies, and any code that appeared in the transcript. Switching the Compressor off stops this too. | Your content |
| Your most recent prompt, alongside a file read | The text of your last instruction, so the summary can be steered toward what you actually asked for. On by default, and separately switchable. | Your content |
| An edit whose target text cannot be found in the file | The file and the text that failed to match, so a correction can be suggested. Switchable to local-only. | Your content |
| Summarising a directory | File and directory names only. No file contents are opened or sent. | Metadata only |
| A normal, successful edit | Nothing. The match and the write both happen on your disk. | Nothing sent |
| Listing files by pattern (glob) | Nothing. Results are grouped locally. | Nothing sent |
| Fetching and summarising a web page | The content of the public page that was fetched. This is third-party content, not yours. | Metadata only |
Thresholds are the shipping defaults. Anything below them is handled on your machine and never transmitted.
3. What is never sent, by either half
- Your repository. Lineman never clones, uploads, scans or indexes it. Only the specific output of a tool call is ever transmitted.
- Files you have not asked the agent to open. There is no background crawler.
- Your git history, diffs, or the contents of any commit.
- Your coding-agent transcript file. Lineman reads it on your machine to count tokens, and the file itself is never uploaded.
- Your environment variables, shell profile, or SSH keys.
- Your machine's hostname, your operating-system username, or your IP-derived location.
- Your Anthropic API key or coding-agent credentials. Lineman never sees them.
- Your email address. Where an account identifier is needed it is hashed on your machine first.
4. How long any of it is kept
File contents and command output
Held in memory for the moment it takes to produce the summary, then discarded. They are not written to a database and there is no stored copy to retrieve afterwards.
Conversation segments from Smart Compaction
Cached for 24 hours in an encrypted in-memory store, so your agent can retrieve the detail it set aside, then automatically deleted. Switching the Compressor off stops these being created at all.
Cost rows
Retained for as long as your account is open. They are your cost history, and they contain no code.
Request metadata
For each compression we keep an accounting row: the task type, the size in bytes, the token counts, and the parameters of the call. For a shell command that includes the command text, for a search the pattern, for a file read the file path, and where prompt-steering is enabled, your instruction. It never includes the file contents themselves.
Compression runs on contracted GPU inference providers, bound by a written data-processing agreement and named individually in Annex C of our Data Processing Agreement. Your content is never used to train, fine-tune or evaluate any model. All traffic is TLS-encrypted in transit and encrypted at rest.
5. Turning the Compressor off
Everything in section 2 is one switch in your dashboard. Turn the Compressor off and nothing you write, read or run is transmitted, at all. Your Cost Explorer keeps working, so you still see what your agents cost you. Nothing else changes.
The switch is enforced by our API, not merely honoured by the plugin on your machine. Once it is off, a request that carries your content is refused on your account identity alone, before the content is deserialized. It is never read, parsed, logged, or forwarded to a model. So it does not matter what a client claims or whether it is up to date. An administrator can lock the choice for the whole company.
| Who can set it | Where | What it does |
|---|---|---|
| Any member, for themselves | Settings, Your data | A single switch: Let Lineman compress my code to save tokens. Turn it off and the Compressor stops entirely. No file contents, no command output, no search results and no conversation text leave your machine. Your Cost Explorer carries on working exactly as before. |
| An administrator, for the whole company | Team, Data sharing policy | Force it off for every member at once, overriding their individual choice. This is the control to use if your policy is that source code must not leave your estate. Members can see it is locked and who locked it, and they cannot switch it back on. |
A change applies to new agent sessions immediately. A session already running can take up to five minutes to pick it up.
On the free plan, your code is never read
The free tier is cost-reporting-only by design. The Compressor is refused both in the plugin and at our API, and the refusal happens before any of your code is deserialized, so it is never read, parsed, or forwarded to a model. If you want to evaluate the Cost Explorer against a sensitive codebase before talking to us about anything else, you can do that today.
Questions security teams ask
Does Lineman send my source code anywhere?
- The Compressor does, and it has to: it works by having a second, cheaper model summarise things so your expensive model does not have to read them in full, and that model cannot summarise a file it has not been given. The exact triggers are listed on this page. The Cost Explorer does not. It sends token counts and cost metadata only, and it never reads your files at all.
Can I use the Cost Explorer without ever sending code?
- Yes. Switch the Compressor off in Settings, under Your data, and cost reporting keeps running on its own. An administrator can lock that choice for the whole company from the Team page. The switch is enforced by our API rather than merely honoured by the plugin: once it is off, a request that carries your content is refused on your account identity alone, before the content is deserialized, so it is never read, parsed, or forwarded to a model. Free-tier accounts are cost-reporting-only by design, so the same applies on the free plan.
Is my code used to train a model?
- No. Your content is never used to train, fine-tune or evaluate any model, ours or anyone else's.
Who else processes my code?
- Compression runs on contracted GPU inference providers under a written data-processing agreement. They are named individually in Annex C of our Data Processing Agreement, which is published in full.
Is my code stored?
- File contents and command output are processed in memory and discarded once the response is returned. The one exception is Smart Compaction, which caches conversation segments for 24 hours so your agent can retrieve them, and which you can disable or keep entirely on your own disk.
Does Lineman send the names of my private repositories?
- The Cost Explorer sends your repository name, branch name and commit SHA in the clear, because attributing spend to a repository, a branch or a ticket is exactly what it exists to do. It sends no code, no file contents and no file paths. If that attribution is not something you want, talk to us and we will turn cost reporting off for your account.
Still need something answered?
If your security review needs a question answered that this page does not cover, ask us and we will answer it precisely. We would rather have the conversation than have you guess.
This page describes the shipping behaviour of the Lineman plugin. If what the plugin transmits changes, this page changes with it.