Skip to content

Security & Privacy

Privacy notice (shown in-app on first run)

The application collects usage metadata only from official Anthropic APIs and official export files:

  • Directory data: name, email address, role, seat/membership status, invitation state, join date.
  • Activity counts: conversations, messages, active days, projects, files uploaded (counts only), artifacts, skills, connectors, plugins, Claude Code sessions, lines-of-code counts, commits, pull requests, tool accept/reject counts, and equivalent counts for other Claude products.
  • Consumption: token counts by type/model and cost figures.

It never collects, stores, displays or transmits conversation content, prompts, responses, uploaded file contents, or source code. All API access is read-only; the application never modifies, suspends or removes any account.

Where data lives

Everything is local to the Windows user profile: %LOCALAPPDATA%\ClaudeOrgUsageMonitor\ (SQLite database, generated reports, backups, redacted logs). Nothing is sent anywhere except (a) requests to api.anthropic.com and (b) optional email reports you explicitly configure.

Credential handling

  • API keys, the SMTP password, the Microsoft Graph client secret and the backup-encryption key are stored in the Windows Credential Manager (service ClaudeOrgUsageMonitor) via keyring — never in files, the database, settings, exports or logs.
  • The UI shows secrets masked (************xxxx) and key fields are password-echo inputs.
  • Every log handler and stored API error passes through a redaction filter that strips sk-ant-… keys and bearer/header values; the automated tests assert keys cannot appear in the request log.
  • If no OS keyring backend is available (rare, locked-down hosts), a clearly-labeled reduced-security fallback file (machine+user-derived obfuscation, 0600 permissions) is used; this is not hardware-backed and is called out in the UI backend name.

Network security

  • TLS certificate validation is always on (httpx defaults; the option exists only as a setting surface and ships enabled — do not disable it).
  • Only api.anthropic.com (and, if configured, your SMTP host / login.microsoftonline.com + graph.microsoft.com) are ever contacted.
  • Requests carry an identifying User-Agent per Anthropic integration guidance.

Output hardening

  • CSV/Excel formula-injection protection: any exported text cell whose first non-space character is = + - @ (or tab/CR) is prefixed with ' — covered by tests for both CSV and XLSX writers.
  • Filename sanitization: report/export filenames strip reserved and control characters and Windows reserved device names.
  • Imported files are validated row-by-row (email format, ISO dates, non-negative numbers, duplicate detection); rejected rows are stored with reasons, never silently dropped. API responses are validated with pydantic schemas before ingestion.

Financial accuracy

All money travels as decimal.Decimal; official cents-denominated values convert exactly (cents ÷ 100), are stored as decimal strings, and are summed with Decimal — never binary floats. Tests assert 0.1 × 10 == 1.0 exactness and cent-string conversion.

Auditability

The local audit trail records every configuration change, scoring-policy version, exemption change, sync, import, report generation and alert action, with timestamps and (redacted) details. Retention for metrics, audit events and the API request log is configurable; a data-retention purge runs after each sync.

Backups & encryption at rest

  • One-click backup uses the SQLite online-backup API (consistent while the app runs), with integrity verification and configurable retention.
  • Optional encrypted backups: Fernet (AES-128-CBC + HMAC-SHA256, cryptography package) with the key held in the Credential Manager. Restores validate the file (header + PRAGMA integrity_check) before the live database is replaced, and the replaced file is kept as *.pre_restore.
  • For at-rest encryption of the live database, rely on Windows device encryption (BitLocker) / EFS on the %LOCALAPPDATA% volume; the app deliberately avoids bundling a nonstandard SQLite cipher build. This is the documented, supportable posture for a desktop tool.

Application behavior limits

  • Monitoring and reporting only — no write scopes, no account lifecycle actions, ever.
  • Alert emails contain usage metadata only; templates cannot access secrets (only the whitelisted variables are passed to Jinja2 with StrictUndefined).
  • Exempt users remain visible and labeled — exemptions suppress alerts, not visibility, so the tool cannot be used to quietly hide accounts.