Trust

Security and data access

Last updated October 30, 2026

idle is read-only by design. It never sits in your request path, never changes your infrastructure, and today it never asks for cloud credentials. This page lists exactly what it reads and stores.

What idle reads today

• Data you send. Per endpoint and day: cost, GPU-hours, utilization, input and output token counts, request counts and p95 latency. You send it as a CSV upload or through the ingest API.
• Endpoint settings you enter. Model name, GPU type and count, provider, region, price per GPU-hour and latency SLO.
• Probe results. If you add a probe, idle sends a GET request to the public URL you give it and stores the status code and response time.
• Your Google account basics. Name, email and profile picture, used to sign you in.

What idle never reads

• Prompts, completions or any model inputs and outputs.
• Cloud account credentials. idle has no connector into AWS, GCP, Azure or GPU clouds yet.
• Anything on private networks: probes refuse URLs that resolve to private or internal addresses, never follow redirects and send no credentials.

Cloud connectors (coming later)

When idle adds connectors that read billing exports directly, this page will list the exact permissions before you grant anything. They will be read-only and scoped to billing data (for example, the bucket that holds an AWS Cost and Usage Report or a BigQuery billing export dataset), never compute, IAM or network permissions.

How data is protected

• API keys are shown once at creation. idle stores only a SHA-256 hash, and you can revoke a key at any time.
• Sessions use signed, HTTP-only cookies after Google sign-in. Workspace data is always filtered by your workspace on the server.
• Transport is HTTPS end to end.
• Hosting is on Railway with a managed Postgres database.

Deleting your data

Removing an endpoint stops its probes and hides it from dashboards. To delete a workspace and all its data permanently, ask us and we’ll do it.

Reporting a vulnerability

Use the contact form. We’ll acknowledge reports and keep you updated until a fix ships.