Metadata first. Prompts on your terms.

We connect via official APIs with read-only permissions. EngLedger cannot modify your code, settings, or project data.

We never store or scan source-code contents, file bodies, or diffs. Commit syncs record file paths and line counts only, enough to validate effort, never the code itself.

Every administrative and data action is written to an append-only, monthly-partitioned audit log, and each organisation's data is isolated at the row level.

Work-intent classification runs on a self-hosted model inside our boundary. Prompt excerpts are never sent to a third-party model.

Captured prompt content is held for a configurable window (90 days by default), then hard-deleted or redacted. The reporting metadata is kept; the prompt text is not.

Each person authenticates with their own identity. Reporting leads with organisation- and team-level views; individual detail is opt-in, and we never produce individual performance rankings.