How the benchmark handles your numbers

What never leaves your browser

• The file. It is read and analysed by JavaScript in your tab and never uploaded.
• Anything written in it. Never rule names, never the file name, never project or space names, never trigger or action text.
• Your exact seat count and allowance. Only a seat band is sent, because allowance and tier together would give the seat count back.

What the request holds

One request to /e/bench on this site, about ten seconds after your report appears, and an update at most every 30 seconds while you change the calculator. Every value is a number:

The report shows the exact request under See exactly what is shared, and you can match it against your browser's network tab. This site's Content-Security-Policy blocks fetch, XHR and WebSocket connections to everywhere except one address, the optional summary email below, so this image request is the only one that carries numbers without you asking.

"Email me this summary"

Under the cost estimate you can type an email address and press Send me this summary. Only then, and only when you press it, the page sends one request to https://www.releaseteam.com/wp-json/releaseteam/v1/email-report holding exactly: your email address, the name of this tool, the estimated steps per month, the estimated monthly overage in dollars, the number of rules flagged, and the Jira and Confluence plans you picked. Never your file, the file name, any rule name or your seat counts. That address is the only one this site's Content-Security-Policy lets the page connect to, and releaseteam.com refuses any request carrying anything else.

releaseteam.com emails those figures back to you with a link to this tool and does not keep a copy of them. To stop the same address or network being used to send many emails, it keeps a short-lived counter under a keyed hash of your address and of your IP address, for at most a day. The optional Also send me DevOps Roundup monthly box is unticked unless you tick it; if you do, your email address alone is added to our DevOps Roundup list in Constant Contact, tagged with this tool's name, and every issue has an unsubscribe link.

What we store

For each request, one line: the date (not the time) and the numbers above. No IP address, no browser or device details, no cookies. Your address is used in memory for a rate limit against abuse and is not written down. Requests from other websites, and requests over the rate limit, are not stored at all.

Once a day, a backup copy of the previous day's lines goes to a private Amazon S3 bucket in the same AWS region as this site. It holds the same lines and nothing more, and the server can add to it but cannot read it back.

This is the server configuration that does it, quoted from the code we run:

limit_req_zone $binary_remote_addr zone=steps_bench:1m rate=10r/m;
map $time_iso8601 $bench_day {
    "~^(?<d>[0-9]{4}-[0-9]{2}-[0-9]{2})" $d;
    default "-";
}
map "$status|$http_sec_fetch_site|$http_sec_fetch_dest" $bench_req_ok {
    "200|same-origin|image" 1;
    default                 0;
}
map $args $bench_args_ok {
    "~^[a-z0-9=&.-]{1,600}$" 1;
    default                  0;
}
map "$bench_req_ok$bench_args_ok" $bench_ok {
    "11"    1;
    default 0;
}
log_format steps_bench '$bench_day $args';

location = /e/bench {
    limit_req zone=steps_bench burst=20 nodelay;
    limit_req_status 429;
    limit_req_log_level info;
    access_log /var/lib/steps-bench/bench.log steps_bench if=$bench_ok;
    add_header Cache-Control "no-store" always;
    add_header X-Content-Type-Options "nosniff" always;
    empty_gif;
}

How it is used

• We combine rows into typical ranges (the middle half of estates) per seat band, and only once a band holds at least 50 reports.
• Anything we publish is those ranges, rounded. Never an individual row.
• Rows are kept for 24 months and then deleted, from the backup copy as well.

Opting out and removal

• Before it is sent: untick Add this report's numbers to the industry benchmark under your report. Nothing is sent, and the report is unaffected.
• After it is sent: unticking stops further updates. To have rows removed, email the removal token shown on your report to info@releaseteam.com. We remove every row carrying it, and the backup copy is rewritten without them the next day.
• The sample report never sends anything.