Security & privacy
Metadata-only ingest, keys, regions, and access control
ShipGauge is designed so you can measure and gate LLM features without uploading prompts.
Data we collect
| Category | Examples |
|---|---|
| Usage metadata | model, provider, tokens, estimated cost, latency |
| Product labels | feature_id, environment, optional customer_id |
| Eval artifacts | scores, pass/fail, gate reports |
| Account | email, org membership, billing identifiers |
Data we do not collect
- Prompt text / completion text via the official SDKs
- Full request/response bodies from wrapped chat APIs
If you post custom payloads to the ingest API, do not put secrets or raw PII in metadata fields.
API keys
- Prefer project-scoped ingest keys (
sg_ingest_...) - Rotate from Account → API keys if leaked
- Never commit keys; use CI secrets and environment variables
Access control
- Org roles:
adminvsmember - Team SSO for corporate domains (Enterprise SSO)
- Staff console is ShipGauge operators only — not part of customer org RBAC
Data residency
Projects/workspaces can select a data region during setup when the platform offers regional storage (for example US / EU). Confirm the region shown on the project or workspace settings for your account.
Integrations & encryption
Integration secrets (GitHub App keys, OIDC client secrets, polling keys) are encrypted at rest when the deployment configures an integration secrets key.
GDPR compliance & data deletion
- User Account Deletion: When you delete your ShipGauge developer account (via Account → Privacy), all organizations solely owned by you, along with their associated projects, alert rules, and all raw LLM telemetry events (
eventstable), are completely physically deleted from our databases (via cascade deletion). - Data Retention: By default, raw event telemetry is retained according to your plan's retention settings (cleanup crons run nightly) and is physically purged thereafter.