Garlic Score: what to send
Garlic is a trading name of Gible Ltd. Updated 3 October 2026.
One export, 7 days, and your Garlic Score comes back within 48 hours. This page covers exactly what we need, what not to send, and what happens to your data.
First, the data processing agreement. We sign it with you before any logs arrive.
What we need
Seven days of questions your signed-in users asked your product, one row per question.
| Field | Needed? | Notes |
|---|---|---|
| Timestamp | Required | ISO 8601 (2026-09-16T09:33:22Z) or Unix time. Include the time zone if you can |
| Account ID | Required | Pseudonymised (see below). It must stay the same for the same user across the 7 days |
| Question text | Required | The user's message only |
| Session or conversation ID | Recommended | If you don't have one, we rebuild sessions from gaps in activity |
| IP address, hashed | Optional | Helps show when several accounts are run by one operator |
Your field names don't need to match ours. We read common names (created_at, user_id, conversation_id, prompt, messages …), including nested JSON. If yours are unusual, tell us which field is which.
Formats
CSV, JSON Lines or a JSON array, gzipped or not. A database dump that mixes user and assistant rows is fine, as long as a role column says which is which: we keep only user messages. For exports over 1 GB, send JSON Lines or CSV.
timestamp,account_id,session_id,question
2026-09-16T09:33:22Z,a1f9c3e2,s-8812,What are the safeguarding rules in Lithuania?
What not to send
- Your system prompt or instructions. That's what you're protecting, and we don't need it.
- Your product's answers. Our checks read only what users asked.
- API keys, payment data, or anything from users who aren't signed in.
Before you send
Pseudonymise account IDs and hash IP addresses with a secret only you keep, so we never see real identifiers. The same input must give the same output:
import hmac, hashlib
SECRET = b"keep-this-private" # never send it to us
def pseudo(value): return hmac.new(SECRET, str(value).encode(), hashlib.sha256).hexdigest()[:16]
Remove emails and phone numbers from question text where you can. Before any analysis we also strip emails, phone numbers, card-like numbers and raw IP addresses automatically.
Where it usually lives
- The messages table in your database
- An export from your LLM tracing or observability tool
- Your application's request logs
How to send it
Once the agreement is signed, we share a private Google Drive folder that only you and Garlic can open. Please don't email logs.
When the file arrives we check automatically that it can be scored and tell you if anything's missing.
What happens to your data
- It is processed only on systems Garlic controls, with deterministic checks. Your logs aren't sent to AI model providers.
- A person at Garlic reviews every report before it reaches you.
- Raw logs are deleted within 30 days of your report. We keep only derived signals.
- De-identified extraction patterns (signals and verdicts, no text and no identifiers) help us recognise the same patterns for other founders. You can opt out.
- What you get is evidence, not proof: which accounts show extraction patterns, and how much of your product they covered.
Questions: hello@garlic.is