Skip to content

Security FAQs

How are credentials stored and managed?

It depends on where you add the connection.

Connections you add in the IDE extension or the datamate CLI stay on your machine. They are never sent to Altimate, and the MCP server connects to your data tools directly from your machine, over stdio, Streamable HTTP or SSE. Learn more

Connections you save in the Altimate web app are stored by Altimate. Secret fields (passwords, tokens, keys and credential files) are encrypted before they are stored. The hosted remote MCP server uses these connections, and your local MCP server can use them too.

The remote MCP configuration contains your API token. Treat the configuration you copy from the web app like a password: don't commit it to a repository or share it.

What data do Altimate Workspaces collect?

We DO NOT collect any Actual Customer Data

We collect minimal Metadata necessary for full functionalities:

  • Usage Metadata
  • Configuration Metadata (tool registrations)
  • For debugging, we might ask for logs, and check other telemetry data per VSCode guidelines for error reporting and usage metrics.
  • Memory can be turned on for each workspace. It stores a high level summary of metadata around tasks being executed in IDEs to be referenceable in future work as added context. The lifecycle of this can be controlled.

What is your security architecture?

Workspaces are local-first. By default the MCP server runs on your machine and connects to your data tools from there, using connections stored on your machine. Only metadata and usage analytics are sent to our platform, over TLS 1.3 encrypted connections.

The exception is the hosted remote MCP server, which you can use instead of a local one. It runs on Altimate's infrastructure and uses connections saved in the Altimate web app, so tool calls, and the data they return, pass through Altimate's servers.

Our SaaS platform runs on AWS infrastructure within a private VPC, isolated from the public internet.

What compliance certifications and infrastructure security do you maintain?

We maintain compliance with industry security standards:

  • SOC 2 Type II: Audited annually for security, availability, and confidentiality controls

  • Enterprise Security: Our infrastructure is hosted on AWS within a private VPC, with network isolation, security groups, and AWS IAM-based RBAC access controls. Only authorized developers can access production systems through AWS SSO with MFA enforcement for any debugging.

If you need us to do a security review with your IT / security teams, please contact us via chat or Slack.

Do you use my data to train your AI models?

At Altimate AI, our primary objective is allow our users to automate their data work using Altimate Workspaces, locally within the confines of their own systems. We do not use any customer data to train any models. Any data processed by our service is not repurposed for model training or enhancement. Your data is -

NOT available to other customers. NOT available to Altimate AI for any model training or improvements. NOT used to improve any 3rd party products or services

How is the knowledge base secured?

Organization-specific knowledge bases uploaded to the SaaS UI are encrypted at rest and in transit via TLS.

The MCP server running in your editor serves documents through private links, which only your editor's integration can authenticate.

What's your stance on GDPR?

We do not store any actual customer data, we only store aggregate statistics and metadata. As a result, GDPR data deletion requests do not need to be propagated to us because we do not store such data. Our customers typically do not request or require DPAs. However, we're happy to provide a DPA or review a vendor DPA if your organization needs it.

LLM & AI Security

How does Altimate handle LLM access?

Altimate gives you two options for LLM access:

  • BYOK (Bring Your Own Key) — Always free and unlimited. Use your own API keys from any of 35+ supported providers (Anthropic, OpenAI, AWS Bedrock, Azure OpenAI, Google, Ollama, and more). With BYOK, your data goes directly to your chosen provider — Altimate never sees it.

  • Altimate LLM Gateway — A managed option for users who don't want to manage API keys. The gateway dynamically routes to the best model for each task. See below for its security details.

Does the Altimate LLM Gateway store my prompts or responses?

Your full prompts and responses are not retained after processing. Your data is not used to train, fine-tune, or improve any models.

The gateway does store limited metadata for each request:

  • Number of prompt and completion tokens
  • Latency
  • Model used

This metadata is used for billing, performance monitoring, and routing optimization.

Additionally, a small number of prompts are sampled for anonymous categorization to power routing and model ranking. This categorization is stored completely anonymously and is never associated with your account or user ID. No code, SQL, credentials, or PII are retained.

You can opt out of all telemetry by reaching out to us via the Intercom chat built into the Altimate dashboard.

Can I use my own API keys instead of the Altimate LLM Gateway?

Yes. BYOK (Bring Your Own Key) is always free and unlimited. Altimate Code supports 35+ LLM providers including Anthropic, OpenAI, AWS Bedrock, Azure OpenAI, Google, Ollama, and many more.

With BYOK, your data goes directly to your chosen provider — Altimate never sees it. This is ideal for users with existing API keys or strict data residency requirements.

What metadata does the Altimate LLM Gateway collect?

Metadata Purpose
Number of prompt tokens Usage tracking and billing
Number of completion tokens Usage tracking and billing
Latency Performance monitoring
Model used Routing optimization
Anonymous prompt categorization (sampled) Model ranking and routing

Prompt categorization is stored completely anonymously — never linked to your account or user ID. You can opt out via the Intercom chat in the Altimate dashboard.

🔒 Key Security Promise

Credentials you add locally stay on your machine

  • Local connections and your API key are kept on your machine and never sent to Altimate

  • Local connections are made directly from your machine

  • Connections saved in the Altimate web app are stored by Altimate, with secret fields encrypted, and are used by the hosted remote MCP server

  • SOC 2 Type II certified with enterprise-grade security controls

  • Zero trust architecture

If you need us to do a security review with your IT/security teams, please contact us via chat or Slack.