No authentication, no user/team attribution

No authentication; reachable only via VPN. Sender of usage data cannot be traced on the data level. Prompt content is never collected or sent to the backend — only token counts.

Deliberate data-minimization choice. Any feature needing per-user or per-team granularity (e.g. “aggregate by team”) requires a separate, dedicated decision to introduce auth infrastructure.

The backend stores the ingest user_id in a users table, solely to count active installations per provider (last_data_sent, provider). Usage records carry no user_id — token/cost/CO2 data is never linked to an individual.