SightLift

Data access & privacy

How much you connect is how much SightLift can do — and how to enable each level safely.

← Back to the data sources guide
SightLift watches how work gets done, turns the repeatable parts into proven, reusable capabilities, serves them back into your tools, then measures whether they're used and still correct. Everything past basic measurement is off by default and you control it — start minimal and add more per team as your security review is comfortable.
New to capabilities? Start with How capabilities work — the lifecycle, the two kinds, and what each stage asks of you. This page is about the privacy and telemetry levels underneath it.

The levels

If you enable…SightLift can…Exposes
Basic telemetry (base) see what work repeats, surface opportunities, measure adoption metadata only — counts, timing, models, tool names
OTEL_LOG_USER_PROMPTS=1 classify and cluster your work accurately prompt & response text
OTEL_LOG_TOOL_DETAILS=1 capture the command / script that ran, so repeated deterministic work becomes a candidate automation tool inputs (e.g. Bash full_command)
OTEL_LOG_TOOL_CONTENT=1 + tracing prove an automation reproduces your real results before offering it back tool output (truncated at 60 KB)
Connect the SightLift tool serve capabilities into your tools and prove them as they're used — works with all content redacted nothing beyond the tool calls you make to it

You can run the whole loop at the basic level: with no content flags, SightLift still measures your work and proves capabilities forward from live use.

1. Basic setup (start here)

Follow Live telemetry setup to point Claude Code / Cowork at your ingest endpoint, and add the SightLift tool (MCP connector) in your tool's settings (your admin can push it org-wide). That alone runs the loop — no content access needed.

2. Better classification (optional)

export OTEL_LOG_USER_PROMPTS=1
export OTEL_LOG_ASSISTANT_RESPONSES=1

Adds real prompt/response text so SightLift classifies your work more precisely than metadata alone.

3. Automation harvesting (optional)

To let SightLift build proven, deterministic automations from work you already do in Claude Code / Cowork, add tool content:

# the command / script
export OTEL_LOG_TOOL_DETAILS=1

# the tool output (requires tracing)
export CLAUDE_CODE_ENHANCED_TELEMETRY_BETA=1
export OTEL_TRACES_EXPORTER=otlp
export OTEL_LOG_TOOL_CONTENT=1

With these on, SightLift can see the exact command and its result, reproduce it against your real examples, and only then offer it back as a verified automation.

4. claude.ai chats (optional, Enterprise)

To include claude.ai chat work, create a Compliance Access Key in claude.ai with the read:compliance_user_data scope and add it in SightLift's integration settings. This covers claude.ai chats; Claude Code / Cowork are covered by steps 1–3.

Security & privacy

Can we start with no content at all? Yes. Basic setup plus the SightLift connector runs the whole loop — SightLift proves capabilities forward from live use, so nothing in steps 2–4 is required to get value.

What exactly do the content options expose? Step 2: your prompt and Claude's response text. Step 3: the commands your tools run and their output. Step 4: your claude.ai chat messages and tool activity. Each is a separate switch you control and can turn off at any time.

What does the SightLift hook send? If you install the optional prompt hook (the proactive suggestion trigger), it sends each prompt's text to SightLift to check for a matching capability — even if your telemetry content options are off. It suggests something only on a strong match, and never shares the prompt beyond your organization. If you'd rather not send prompts, skip the hook: the SightLift tool still works passively (your assistant can find capabilities by name), just without proactive suggestions.

Where does content go, and how is it protected? Content is scoped to your organization only — never shared across tenants. Tool content is retained only for the specific work being turned into a capability, minimized, and dropped once that capability is proven.

What about deletion / GDPR? Retained content follows your deletion and retention policies. When you erase a conversation, its retained content is erased too; SightLift keeps only a de-identified record of the proof, so nothing personal outlives your erasure.

Do we have to enable everything to get started? No. Most customers start at step 1 + the connector, add step 2 for accuracy, and enable step 3/4 for specific teams once their security review is comfortable.

Need help choosing a level for your risk profile? Contact your SightLift account team.