Security & data flow

Your code stays yours.

Plain answers to the questions security teams ask about CSPeach. No badges, no certification logos — just how the data actually moves, so your architects can verify it themselves.

How it reaches SAP

Laptop-direct. Nothing in between.

The cspeach CLI runs on the developer's machine and talks to your SAP system over ADT REST — the same protocol Eclipse ADT uses — directly from the laptop. ADT traffic never transits CSPeach servers, in any mode. SAP credentials (user/password or X.509) stay in the laptop's OS keychain.

Stays on your side

laptop ↔ your SAP · never transits cspeach.dev
  • ABAP source reads and writes — every ADT call goes laptop → SAP
  • SAP credentials — OS keychain on the developer's machine
  • Syntax checks, ATC runs, activations, transports
  • Snapshots taken before every write — stored locally
  • SAP audit identity — the real developer in CHANGE_LOG, not a bridge user

Touches our side

only in managed LLM mode · api.cspeach.dev
  • LLM prompts and responses — when a skill includes code you asked it to read, that prompt transits our proxy on its way to Anthropic
  • Usage metadata — tokens, model, cost, for metering and billing
  • Account info — from sign-in (device-code flow)
  • Skill definitions — fetched by the CLI, signed

Source your team never shares with a skill never leaves SAP. Full diagram and architect FAQ on the architecture page.

Where the AI runs

Four LLM modes. You pick the boundary.

The SAP path is identical in every mode. What changes is where the AI call goes.

Today · default

Managed

Our Anthropic key, on our proxy. Prompts and responses transit api.cspeach.dev so we can meter and bill per use. Lowest-friction way to start.

In the CLI · verifying

BYOK

Your own Anthropic key, stored in your OS keychain. LLM traffic goes laptop → Anthropic directly — we never see your key or your prompts. The code path ships in the CLI; we're finishing end-to-end verification before calling it generally available.

On the roadmap

SAP AI Hub

Your AI Core token, your BTP tenant. LLM traffic goes laptop → your SAP AI Core. Requires a customer-side translation proxy — details on the architecture page.

On the roadmap

Local

A local model on your own hardware. Nothing leaves the machine. For teams whose policy rules out any external AI call.

Write safety

Every write is gated, logged, reversible.

CSPeach can write to your SAP system — that's the point. It does so under ten Forge Rules embedded in every skill, and every write waits for the developer's explicit approval.

R1No blind generation. It asks the missing questions before touching anything.
R6Read-only by default. Writes happen only when you asked for them.
R7Snapshot before every write. The prior state is captured first — always a way back.
R8No batch without a plan. Multi-object changes need your approved plan, object by object.
R9Transport isolation. Each session's changes land in their own transport — clean audit trail.
R10Verify after every write. Syntax check, then activation check. Failures stop the run.

Telemetry

What we collect. Stated plainly.

The CLI sends no analytics or telemetry events today. There is a telemetry setting in the CLI config (default minimal) reserved for future use — no emitter is wired to it. If that changes, this page changes first.

What our servers do see: in managed LLM mode, your prompts and the model's responses transit api.cspeach.dev on their way to Anthropic, and we record usage metadata — tokens, model, cost — to meter and bill. Your account email from sign-in. That's the list.

What our servers never see: your ADT traffic, your ABAP source outside the prompts you choose to send, your SAP credentials, your SAP system addresses.

In the same spirit of honesty

What's not ready yet.

The lifecycle you see on the tour is live today — including SAP writes, RAP end-to-end, ATC and transports. A few edges aren't finished, and we'd rather you hear it from us:

  • ABAP Unit execution — /abap-test writes test classes, but running them from the CLI doesn't work yet. Run them in Eclipse for now.
  • SEGW, number ranges, message classes — guidance-only in places where the needed SAP APIs don't exist on modern systems. The skill tells you the exact GUI steps instead of doing them.
  • Freestyle Fiori — in progress, not released.