> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & deployment overview

> How the Enfors gateway is deployed, what it captures, and the controls around it — for IT and security reviewers.

Enfors captures AI activity two ways, with **no code changes**:

* **Coding assistants** — Claude Code (CLI) and Claude Desktop — are captured by the local
  **watcher**, which reads their session transcripts and uploads completed turns to
  `data.enfors.ai`. It reads files only; no proxy, no TLS interception, no certificate. This
  **replaces the earlier mitmproxy approach**.
* **Agent SDKs** (e.g. the OpenAI SDK) call the **Enfors gateway** (`llm.enfors.ai`)
  directly, where each call is captured and enqueued.

<Info>
  This section is the buyer- and IT-facing summary. A complete **IT & CISO Deployment
  Package** — with the watcher/gateway internals and the MDM (Jamf/Mosyle) rollout runbook — is
  available under NDA from your Enfors representative.
</Info>

## What it does

* Captures LLM / agent–human **sessions**, identity, and context — who, when, how.
* Records the full decision record: **inputs, evidence, reasoning trace, tool activity,
  findings, artifacts, operational telemetry, and metrics**.
* Gives IT and AI leadership visibility into who is using what, when, and how much.
* Enables **cost allocation and ROI** measurement across the AI workforce.
* **Discloses itself to the monitored user**: the Enfors mark is shown in the macOS menu
  bar or the Windows system tray exactly while capture is active (see
  [the menu bar / tray indicator](/integrations/gateway-installer#the-menu-bar--tray-indicator)).

## What it does **not** do

* It does **not** modify the content of AI conversations.
* For coding assistants, it does **not** run a proxy, intercept traffic, or install a
  certificate — the watcher only reads the local transcript.
* It does **not** touch provider authentication or credentials.

## How it's deployed

| Aspect               | Detail                                                                                                                                                                                                     |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Watcher**          | Local Python process, run at login as a macOS LaunchAgent (`ai.enfors.watcher`) or a Windows Scheduled Task (`EnforsWatcher`); reads Claude Code + Claude Desktop transcripts, uploads to `data.enfors.ai` |
| **Gateway host**     | `llm.enfors.ai`, AWS us-east-1 — captures agent-SDK calls (e.g. OpenAI SDK)                                                                                                                                |
| **Built on**         | LiteLLM gateway + a single-file watcher                                                                                                                                                                    |
| **Auth**             | Gateway: per-tenant LiteLLM key. Watcher: Cognito OAuth2 + PKCE id-token                                                                                                                                   |
| **Inbound firewall** | None required                                                                                                                                                                                              |
| **Backend region**   | AWS us-east-1                                                                                                                                                                                              |

## What the system answers

1. **What did our agents produce?** — an inventory of meaningful outputs per session.
2. **What are people using AI for?** — use-case classification by person, team, and tool.
3. **Is this a one-off or a pattern?** — behavioral signatures over time, so recurring work
   worth standardizing is distinguished from episodic exploration.

## In this section

<CardGroup cols={2}>
  <Card title="Data captured vs. not captured" icon="table-list" href="/security/data-handling">
    What's captured (gateway + watcher), what is never captured, and the PII nuance.
  </Card>

  <Card title="Data residency & retention" icon="database" href="/security/data-residency-retention">
    Region, encryption, and retention periods.
  </Card>

  <Card title="Tenant isolation & access" icon="lock" href="/security/tenant-isolation-access">
    Row-Level Security and access controls.
  </Card>

  <Card title="Network & TLS" icon="network-wired" href="/security/network-tls">
    Connection paths and endpoints for the gateway and the watcher.
  </Card>

  <Card title="Security controls summary" icon="shield-check" href="/security/controls-summary">
    The control-by-control summary and how to get the full package.
  </Card>

  <Card title="Enterprise deployment" icon="server" href="/admin/deployment">
    Fleet rollout via MDM (Jamf/Mosyle).
  </Card>
</CardGroup>