The architecture
How coding agent sessions move from developer machines to your bucket and analytics.
Lambda or stateless container
Control plane
- Manages upload devices and provides credentials for uploading files.
- Shipper calls: Enroll, Remote Config, Authorize.
- Never receives sessions and can't decrypt the data.
- Deduplicates: the Shipper sends a hash of each file first, and the control plane answers if it is already present.
- Stateless: no session content and no key pass through it. Small state lives in the bucket.
- Open source under Apache 2.0 as fleet-manager, implementing the Shipper protocol.
Object storage
Bucket with transcripts
- Versioned S3, Azure Blob, and alike: a synced mirror of session data.
- Receives ciphertext straight from the Shipper upload.
- Encrypted per customer. Long-term raw archive.
v1/organization=<org>/ install=<uuid>/ mirror/ source=<source>/ <64 hex>.age
Open tables
Session data
- Normalized to one format across versions and harnesses.
- Parsed into Parquet data files in Apache Iceberg tables.
- Re-usable for other services, for example security.
- Compatible with Snowflake, Databricks, and other data warehouses.
- Sessions like these improve agents: public datasets such as SWE-chat on Hugging Face are made of them.
Service
Quesma service
- Analyzes the session data: aggregations, enrichments, dashboards, and the UI.
- See the charts (opens in a new tab)
On each development machine or sandbox
After the bucket
On the device
Read
- Reads
~/.claude/projects,~/.codex/sessions, and~/.cursor/projects. - Plus metadata: git remotes, account plan, rate-limit tier.
On the device
Scrub
- Secrets and PII redacted with gitleaks-format rules and an entropy check.
ghp_d23243224q…becomes__REDACTED:github-pat__.- Always on: no configuration layer can switch it off.
On the device
Encrypt
- With your organization public keys.
- age file encryption, X25519 recipients.
- The recipient list is add-only.
On the device
Authorize
- Gets presigned URLs for PUTs from the control plane.
On the device
Upload
- Presigned URL PUT straight to the bucket over HTTPS.
v1/organization=<org>/ install=<uuid>/ mirror/ source=<source>/ <64 hex>.age
After the bucket
Normalize
- Runs outside the Shipper.
- One format across versions and harnesses, as Parquet data files in Apache Iceberg tables.
After the bucket
Analyze
- Runs outside the Shipper, in the Quesma service: aggregations, enrichments, dashboards, and the UI.
- See the charts (opens in a new tab)
Compare deployment modes
| Summary | Archive in your cloud | Your archive and your tables | Quesma hosts everything | Your storage, Quesma analytics | Everything in your cloud |
|---|---|---|---|---|---|
| Quesma can decrypt sessions | No | No | Yes, with your key | Yes, with your key | No |
| Analytics provided by | None | Your tools | Quesma | Quesma | Quesma, in your cloud |
| Control plane | Your cloud | Your cloud | Hosted by Quesma | Your cloud | Your cloud |
| Bucket | Your bucket | Your bucket | Hosted by Quesma | Your bucket | Your bucket |
| Tables and analytics | None | Your tables, your tools | Hosted by Quesma | Hosted by Quesma | Your cloud |
| Private key | Yours only | Yours only | Yours, shared with Quesma to decrypt | Yours, shared with Quesma to decrypt | Yours only |
| You deploy | Shipper, control plane, bucket | Shipper, control plane, bucket, normalizer | Shipper | Shipper, control plane, bucket | Everything, with Quesma software in your cloud |
Open-source archive
Archive in your cloud
- Quesma cannot decrypt
- Analytics: None
Deployment details
- Control plane
- Your cloud
- Bucket
- Your bucket
- Tables and analytics
- None
- Private key
- Yours only
- You deploy
- Shipper, control plane, bucket
Open-source normalization
Your archive and your tables
- Quesma cannot decrypt
- Analytics: Your tools
Deployment details
- Control plane
- Your cloud
- Bucket
- Your bucket
- Tables and analytics
- Your tables, your tools
- Private key
- Yours only
- You deploy
- Shipper, control plane, bucket, normalizer
Professional
Quesma hosts everything
- Quesma can decrypt, with your key
- Analytics: Quesma
Deployment details
- Control plane
- Hosted by Quesma
- Bucket
- Hosted by Quesma
- Tables and analytics
- Hosted by Quesma
- Private key
- Yours, shared with Quesma to decrypt
- You deploy
- Shipper
Business / Enterprise SaaS
Your storage, Quesma analytics
- Quesma can decrypt, with your key
- Analytics: Quesma
Deployment details
- Control plane
- Your cloud
- Bucket
- Your bucket
- Tables and analytics
- Hosted by Quesma
- Private key
- Yours, shared with Quesma to decrypt
- You deploy
- Shipper, control plane, bucket
Enterprise BYOC
Everything in your cloud
- Quesma cannot decrypt
- Analytics: Quesma, in your cloud
Deployment details
- Control plane
- Your cloud
- Bucket
- Your bucket
- Tables and analytics
- Your cloud
- Private key
- Yours only
- You deploy
- Everything, with Quesma software in your cloud
Planned platforms: AWS, GCP, Azure, Cloudflare, Snowflake, and Databricks.
Guarantees
Session data is as valuable as server logs, and as sensitive, so it gets the same handling: scrubbed, encrypted, uploaded to your bucket, normalized.
What is collected
Reads session directories only
Only the agents' own session directories. No other files, keystrokes, screenshots, browser history, or process list.
Credential stores stay closed
~/.ssh,~/.aws, and.envfiles sit on a compiled deny list.Cannot widen what is read
The scope is compiled into the binary, and a new root needs a release.
Open source, auditable
Everything that runs on your devices is open source under Apache 2.0. You are welcome to verify it or contribute.
What leaves the device
Credentials scrubbed before upload
Credentials should not be in agent sessions, but sometimes are. Before anything leaves the machine, the Shipper scrubs by pattern everything that looks like one.
Preview what leaves
quesma-shipper previewshows what the next run would send.Two layers of protection
Cloud permissions on the bucket, and a per-customer encryption key.
Writers cannot decrypt uploads
The keys are public-private: a writer holds only the public key and cannot decrypt what it wrote.
Shared objects leak nothing
An accidentally shared object does not leak session content.
Who can access it
Control plane never sees sessions
It never sees session content and holds no key.
Cannot weaken protections
It cannot remove a reader, a scrub rule, or encryption. A configuration it cannot honor is refused whole.
Local disable always wins
A local disable beats a remote enable.
Staff do not open sessions
Humans get access only on your ticket.
Aggregates, not prompts
Quesma works on the raw sessions, but the product shows aggregates by team, repository, and kind of work, not individual prompts.
Everything that runs on your devices is open source.