Understand ABTO
How it works
How calls and behavior get recorded and meet on one screen, why those numbers can be trusted, and how sensitive content is handled.
Two things do the recording: the gateway records AI calls, the SDK records user behavior, and the dashboard joins the two records and shows them together.
The call record: the gateway relays calls on your behalf and logs cost and latency.
The behavior record: the SDK in your web and app sends user behavior, and the dashboard joins the two records.
Because the gateway relays calls on your behalf, no measurement logic goes into your code, and records are sent separately from the call, so latency is unaffected.
Where the records appear
Section titled “Where the records appear”| Record | Where it appears |
|---|---|
| One AI call | A row on Requests; in aggregate, the summary numbers and charts on Overview |
| A user event | The tracked events table on Success metrics, and the linked events in a call’s detail |
The screens start filling the moment traffic flows.
Why the numbers can be trusted
Section titled “Why the numbers can be trusted”- The gateway and the SDK each record only what they directly saw. The browser never guesses token counts, and the gateway never guesses what happened on screen.
- A user’s behavior accrues to the variant that person received. “Purchase rate of users who got model A” and “purchase rate of users who got model B” split cleanly per person.
- Until you change the routing ratios, the same user keeps receiving the same variant, so one person’s experience stays steady across requests.
- Events are kept on the device through brief network outages and resent, so they are not lost.
What gets stored
Section titled “What gets stored”Each call keeps which model ran, how many tokens (the units models process text in) it used, and what the cost and latency were. Raw prompt and response bodies are stored alongside by default, so the messages actually exchanged can be read in the Requests detail.
Your contracts and API keys with model providers stay yours. A key only rides along with each request and never enters the call records the gateway writes.
How sensitive content is handled
Section titled “How sensitive content is handled”On the user side, only what happened on screen is collected. Text typed into inputs, raw prompt and response bodies, and sensitive screen text are not collected by default and are replaced with a marker that keeps only the length.
You can decide per screen which elements to hide, and allow raw text only where you truly need it. How to declare them is covered in Browser JavaScript.
The raw prompt and response bodies the gateway stores can be turned off at any time. Keep in mind that features which need that content to work will then be limited.
Prompts sent to model providers are forwarded exactly as your server composed them. The gateway neither alters them nor uses them for anything else.