Data protection
The retention default is keep forever, and that is a decision you have to make rather than inherit.
This is already on your desk.
- 01
Prompts are where unplanned personal data accumulates
The trace events table is the highest-sensitivity store in the system, and not by design: prompts and tool arguments are written by people solving a problem, and a customer's name, address or condition arrives inside a sentence nobody classified. - 02
Storage limitation and an evidence obligation pull in opposite directions
One regime asks you to keep logs for at least six months; another asks you not to keep personal data longer than necessary. Both apply to the same rows, and no default resolves that, which is why this one keeps everything and makes you choose. - 03
Erasure requests will arrive for data nobody intended to collect
An erasure request against a prompt corpus is a different exercise from one against a CRM, because the identifier tying a person to the rows is a session or a delegated principal. Reading the corpus to find them is itself a processing act, so the dry run is audited too.
- 01
Is your redaction sufficient?
No, and Token Observe does not claim it is: it is a compensating control, not your only DLP. Detection is regex plus checksum, so what it catches it catches well and what it misses it misses entirely. Cards are Luhn-validated, IBANs mod-97 and NHS numbers mod-11, scoring 0.9 to 0.98; national insurance numbers score 0.85; free-text personal data is not detected at all. Confidence is exposed so your policy sets its own threshold, and secret kinds are always masked irreversibly.
- 02
What is your retention policy?
The cloud pilot configures activity retention to 30 days. Customer hosting has no default period, and unset means keep forever: a decision you have to make rather than inherit. That over-satisfies the six-month minimum in EU AI Act Article 26(6) and satisfies nothing in GDPR Article 5(1)(e), so a GDPR-regulated deployment must set the window. The default is deliberate in both directions: retention should be decided rather than assumed, and an upgrade that silently began deleting evidence would be the worse failure.
- 03
Is the vendor a processor? Do we need a DPA?
Cloud hosting holds workspace evidence and supplied credentials. For customer hosting, in the ordinary supply of the software the vendor holds no copy of anything (no telemetry, phone-home, licence callback or hosted component), and the licence states that as an undertaking rather than leaving it to an architecture diagram, which removes the sub-processor and transfer-assessment path from most procurement. It is deliberately not an absolute: no claim is made that the vendor is legally never a processor, because evaluation, support and incident handling create arrangements counsel has to assess.
Cloud custody and optional customer-hosted controls are described separately. The 24 limits we publish, and the 9 risks a named person has to accept in writing, are on one page.
What we do not claimOne setting decides whether any message text is stored at all.
One configured database holds the entire persistent state, so back that up and you have backed up everything the product durably holds. Its highest-sensitivity table is trace events, and what that table holds depends on one setting. At the metadata default it holds no message text at all. Switch conversation capture to redacted and the same event carries the prompt as sent, the assistant reply, tool arguments and tool results, every string mask-redacted before truncation, bounded to 32,000 characters across at most 100 messages.
- Model response text
- At the metadata default the response event records stop reason, token counts and content-block types and no generated text. Set to redacted, the assistant reply is written as evidence, mask-redacted and bounded.
- Approval records
- The tool name, or the model name on the request path, plus the policy's own reason, mask-redacted, capped at 240 characters, and carrying none of the model's proposed arguments.
- Encryption at rest
- This is where reviewers find surprises: the database file is not encrypted by the product, so it is whatever your volume provides.
- Workspace configuration, registry, policies and decisions
- Billing evidence from the connections and imports you supply
- Supplied connection credentials, encrypted at rest
- Request metadata for traffic routed through the workspace
- Bounded, redacted prompt and reply text when capture is enabled
- Billing queries using the reporting permissions you supply
- Routed model payloads after the applicable policy checks
- Model-assisted search using a separately configured inference key
- Authorized evidence reads and CSV exports to your client
The cloud service processes and stores workspace evidence and supplied credentials. Supabase handles account authentication; Railway runs the cloud pilot. Cloud hosting does not keep all data inside your network.
Billing cannot recover historical conversations. Activity covers routed traffic or supported evidence supplied to the workspace. Text capture is off by default, and redaction is heuristic.
Customer hosting is an optional, separate deployment choice. Its infrastructure and data boundary differ from the cloud pilot.
A retention period does not reach these tables.
A retention statement that promises deletion after N days without naming the exceptions is inaccurate, and a DPO will find them. The window and subject erasure act on traces, trace events, the search index and trace scores. Nothing else. The audit log is untouched by design, so the record of a deletion outlives the deleted data.
- Approvals
- Not purged and not erasable by subject. Each row carries the approver's identity, time and rationale, which is free text a person typed.
- Radar findings
- Not purged, not erasable by subject, and they may carry workstation hostnames, staff usernames and, where an operator supplies per-user spend, named employee email addresses.
- Webhook deliveries
- Not purged. Whatever a webhook carried, that table keeps the exact bytes posted to the receiver.
- Seats, group snapshots and backups
- Outside every control here. The seat census holds identified staff; group snapshots age out on their own twenty-four-hour window; a retained backup preserves whatever existed when it was taken.
This is what does the work.
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Flight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
Model routing
Six upstreams behind one set of policies, and a fallback chain that will not launder a refusal.
Questions
Which data subject rights can this service?
Access and portability directly: a trace read, a digest-sealed export and a period-bounded compliance bundle, in JSON. Erasure and a retention limit act on the live primary once a window is set, so the precise claim is erased from the primary rather than gone from every copy. Minimisation is partial: capture is metadata-only by default, but regex and checksum cannot find free-text personal data. One right has no mechanism: no endpoint deletes an agent and its history.
Does personal data leave our network?
Only to endpoints somebody in your organisation configured, and only after policy evaluation and redaction: your model providers, tool servers, webhook receivers, identity provider and anchor sink, plus a public price catalogue an administrator triggers by hand, and the two vendor pull connectors if you enable them. There is no default egress.
Who inside our organisation can read prompt content?
Whoever you grant it to, scoped twice and recorded. Every account carries explicit team scopes alongside its rank, applied inside the queries and repeated on detail, search and export paths, and a caller cannot widen it with a query parameter. Sensitive reads append attributable audit events, so a read of the prompt corpus is itself part of the record.
Bring the objection that is not on this page.
Create a cloud account and workspace. No card or server installation. Model calls and Google BigQuery scans can incur separate provider charges.