Organization & Cloud

Continuum has an optional organization layer. It does two distinct jobs, and it is worth keeping them apart in your head because they have different consent models and carry different data:

1. Usage reporting — a local collector on each developer’s Mac rolls their token usage and cost up to admins. Off until an employee explicitly opts each work account in.
2. Inference governance — if your team is on Continuum-hosted inference, admins decide which models each person can use and how much they can spend. Enforced server-side.

​

Connecting your Mac

The collector lives in the Mac app, because it reads the on-disk usage files of Claude and Codex logins it can attribute to a single work account. Settings → Your Organisation is always present there. When you are not connected, it shows a single Sign in on the web button. This is a standard device-authorization flow: the app polls the backend while you finish in the browser, and times out gracefully if the request expires or sign-in is declined.

​

Choosing which accounts upload

Linking uploads nothing on its own. In the connected state, a Work accounts to upload list shows every Claude and Codex account on the Mac — your default plus any secondary accounts you configured. Each has an off-by-default switch.

• Turning a switch on is what authorizes uploading that account’s usage. The bound set starts empty, so linking can never silently upload a personal account.
• Only Claude and Codex accounts appear here, because those are the two whose on-disk usage files can be attributed to a single “work” login. Other providers are excluded from upload rather than risk mixing in personal usage.

Once you have at least one account bound, Generate & upload report now collects and uploads immediately, and the device also refreshes the report periodically on its own. With no accounts bound, upload is refused outright.

​

What the collector uploads

The collector reads the bound work accounts’ on-disk usage files with the same parsers the Analytics layer uses, then emits normalized per-event records. Each record carries: The connected screen also shows a What leaves this device panel that lists every egress with its live on/off state: Uploads run through a queued outbox with retry, so a flaky connection leaves a report pending rather than dropping it. The card shows queue depth and a Retry queue button. Each report re-uploads your full usage history under a stable coverage key, so a re-upload replaces the prior set rather than duplicating it. Upload provenance is org-scoped by construction: the device identifier attached to a report is an HMAC of your organization id and the install id, so a consultant linked to two organizations stays isolated between them.

​

Disconnecting

Disconnect clears the org bearer from the Keychain, turns org mode off, clears the upload queue, and resumes your personal iCloud analytics sync. Disconnecting stops future uploads from this device; ask your admin if you need data already uploaded removed.

​

The admin surfaces

Org administration lives in Settings → Your Organisation in the web app at continuumcode.ai/app — and therefore also in the Windows and Linux desktop apps, which render the same code. The group is hidden entirely for accounts that aren’t part of an organization. It shows your organization name, your role (Admin or Member), an invite form for admins, and a Hosted inference row with a Manage button. The Mac app’s pane of the same name is the collector described above — sign-in, work-account opt-in, upload, and the egress panel — not the admin console.

​

Invites

Admins get an Invite a teammate field and a Send invite button. The invitation is issued through WorkOS and the invitee receives a standard organization-invitation email; the local record is only written after WorkOS accepts, so a failed send never leaves a phantom member. Invited people join as members. Non-admins see “An organization admin can invite teammates from this pane.”

​

Hosted-inference governance

Settings → Your Organisation → Hosted inference → Manage is the control plane for team spend on Continuum-hosted inference. It is visible to admins and team leads; members are told the screen is admin-and-team-lead only. Every one of these is enforced by the inference gateway itself. A blocked model returns a 403; an exhausted allocation or budget returns a 429 with the specific reason. Because enforcement is server-side, an older or modified client cannot route around it.

​

How the backend is built

Continuum Cloud runs on Continuum-operated infrastructure backed by Postgres. The public-facing properties that matter:

• Records in, server-rolled. The collector POSTs normalized records to /v1/ingest; the server owns costing, timezone bucketing, deduplication, and attribution. The device never gets a vote on what a token costs.
• Tenant isolation by construction. Tenant tables have Postgres row-level security enabled and forced, with policies keyed on the requesting organization. Forced RLS means the policy applies even to the table’s owner, so an application bug cannot read across tenants by forgetting a predicate.
• Content is sealed at rest. Mirrored transcript pages are encrypted with a per-member AES-256-GCM key. Removing a member destroys that key, which renders their stored content permanently unrecoverable without hunting down every row — see Privacy.

​

Two different clouds, one account

The most common confusion is treating org reporting and personal cloud sync as the same thing. They are separate paths with separate data: If you sign in to a personal Continuum account, cloud sync applies whether or not your machine is connected to an organization. Privacy enumerates both paths byte by byte.

​

Device mesh (separate toggle)

Settings → Account carries a Device mesh switch, separate from usage upload — toggling it never changes upload consent. It enrolls your devices through the cloud relay so they appear in Settings → Devices and can run agents without Tailscale. Signing in turns it on. See Remote devices for how enrolled hosts run sessions.

​

See also