> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Asymptote Cloud

> Send agent telemetry to Asymptote and use the hosted control plane. Nothing to run but Beacon.

In Asymptote Cloud, your endpoints send their telemetry to Asymptote, and Asymptote stores it and runs everything that reads it: the dashboard, search, detections, policy checks and findings. You run only [Agent Beacon](https://docs.asymptotelabs.ai/concepts/core-concepts.md#agent-beacon) on your endpoints. It's the fastest way to start, and the option to pick unless a policy says the telemetry must stay in your own cloud. See [Hosting Options](https://docs.asymptotelabs.ai/deployment/hosting-options.md) for the other two.

## How data flows

```mermaid theme={null}
flowchart LR
  subgraph Endpoints["Your endpoints"]
    Beacon["AI agents and Beacon"]
  end
  subgraph Asymptote["Asymptote's cloud"]
    Ingest["Ingest service"]
    Bucket[("Telemetry bucket")]
    Store[("Analytics store")]
    CP["Dashboard, API, policy service, detections"]
  end
  Beacon -->|"HTTPS, key per device"| Ingest
  Ingest --> Bucket
  Bucket --> Store
  Store --> CP
  Beacon -.->|"live policy checks, if enabled"| CP
```

1. **Enrollment.** [`beacon endpoint connect`](https://docs.asymptotelabs.ai/cli/endpoint-connect) enrolls the device with Asymptote. In system mode, the usual mode for a fleet, it opens the dashboard and a member of your organization approves the device. In user mode, the person's own `beacon login` sign-in to Asymptote authorizes it instead. The device gets its own ingest key, stored in a file only Vector reads. Revoking the device on the dashboard stops its uploads within about a minute.
2. **Upload.** A Vector service on the endpoint sends new runtime events and the inventory baseline over HTTPS, with a disk buffer for offline periods. Each connect also sends the last 30 days of agent sessions, so the dashboard has history on day one.
3. **Storage.** The ingest service checks the key, stamps your organization on every event, and writes it to Asymptote's bucket. Your organization's events load into tables of their own; no other organization's queries can reach them.
4. **Use.** The dashboard, search, detections and background reviews read those tables.

The [Managed architecture](https://docs.asymptotelabs.ai/architecture/managed-architecture.md#how-endpoint-telemetry-reaches-asymptote) page has the detail.

## What you run and what Asymptote runs

| You | Asymptote |
| - | - |
| Beacon on each endpoint, rolled out by hand or through your MDM | Ingest, storage, the analytics store, the dashboard and API |
| Approving devices, or revoking them | Policy checks, detections, background reviews and Slack notifications |
| Choosing a [privacy mode](https://docs.asymptotelabs.ai/cli/endpoint-connect.md#privacy-modes) | Upgrades, scaling, backups and monitoring |

## What Asymptote can see

Asymptote holds what your endpoints send, after Beacon's local redaction of secrets:

* **Standard** mode sends retained content: prompts, responses, tool inputs and outputs, commands and their output, file paths and diffs.
* **Metadata-only** mode removes that content on the endpoint before upload, and sends identifiers, hashes, counts, timestamps, commands, file paths, token usage and other structured metadata.

When [policy enforcement](https://docs.asymptotelabs.ai/manage/policy-enforcement.md) is on, the hooks send the prompt or tool call being checked to Asymptote's policy service, whichever privacy mode the device forwards in.

Telemetry is stored on Google Cloud in the United States. Ask your Asymptote contact about retention terms and other regions.

## Get started

1. Request access at [asymptotelabs.ai/contact](https://asymptotelabs.ai/contact). Asymptote enables your organization for managed ingest.
2. Install Beacon on a test machine and connect it to Asymptote. The CLI's default service is beacon.sh, so name Asymptote explicitly:

   ```bash title="Connect a machine to Asymptote" theme={null}
   sudo beacon endpoint connect --system --dashboard-url https://asymptotelabs.ai
   ```

   A member of your organization approves the device in the browser that opens. To connect in user mode instead, sign in first with `beacon login --auth-url https://asymptotelabs.ai`, then run `beacon endpoint connect --dashboard-url https://asymptotelabs.ai`; the URL must match the sign-in. [Try it on one Mac](https://docs.asymptotelabs.ai/mdm/try-on-one-mac.md) walks through a package install.
3. Roll Beacon out to your fleet with your MDM. See [MDM deployment](https://docs.asymptotelabs.ai/mdm.md).

## Move to BYOC later

Every option uses the same Beacon events, so you can move. Adding a bucket forwarder does not stop the Asymptote Cloud forwarder: the two run side by side. To move to [BYOC storage](https://docs.asymptotelabs.ai/deployment/byoc-storage):

1. Set up your bucket and roll out the bucket forwarder, as in the BYOC storage guides.
2. On each endpoint, run `sudo beacon endpoint disconnect --system` (or `beacon endpoint disconnect` for a user-mode install). It stops the Asymptote Cloud forwarder and removes the device key.
3. Revoke the devices on the dashboard's Beacon Endpoints page, so their keys stop working server-side.

If you use [policy enforcement](https://docs.asymptotelabs.ai/manage/policy-enforcement.md), read [Policy enforcement with BYOC storage](https://docs.asymptotelabs.ai/deployment/byoc-storage#policy-enforcement-with-byoc-storage) first: enforcement needs the device to stay connected. What Asymptote already holds stays under your agreement's retention terms unless you ask for it to be deleted.

## Related

> [card] [Hosting Options](https://docs.asymptotelabs.ai/deployment/hosting-options.md)
>
> Compare Asymptote Cloud with the two BYOC options.

> [card] [Asymptote Managed](https://docs.asymptotelabs.ai/deployment/managed.md)
>
> What the control plane adds: visibility, policy, investigations and access control.

> [card] [Connect an endpoint](https://docs.asymptotelabs.ai/cli/endpoint-connect.md)
>
> Enrollment, privacy modes and what the forwarder sends.

> [card] [Managed architecture](https://docs.asymptotelabs.ai/architecture/managed-architecture.md)
>
> How endpoint telemetry reaches Asymptote, step by step.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.