Where your data goes, and what is written down.
Every statement on this page describes what the system does today, checked against the code that does it. Where something is not true yet, it says so rather than being written in the future tense.
The complete list of third parties that process customer data. Three, and one of them can be replaced by your own account.
ECS Fargate runs the application; RDS Postgres holds tenants, policies, traces and the usage record and is not publicly reachable; Cognito authenticates console sessions; SSM SecureStrings hold secrets; CloudWatch holds application logs.
The only inference route for agent turns today. Question text and retrieved library content reach the model through it. Every request asks OpenRouter for providers that do not train on prompts and for zero-data-retention endpoints only, on every workspace, with no setting to turn it off. A model no provider serves that way is refused when it is chosen, not on the turn it would have failed. On a bring-your-own-key workspace this is your account and your contract, not ours.
Holds the subscription outright — checkout, invoices, payment methods, cancellation. Card details never reach us. No mirrored copy of subscription state is kept here.
One turn, end to end. The point of interest is step four: it is the only step where content leaves our infrastructure, and you can decide whose account it leaves under.
The request arrives
Console traffic is authenticated by the load balancer against Cognito before it reaches the application. API traffic carries a tenant key, which is stored hashed — the plaintext exists only at the moment you create it.
The question is screened
A scope screen decides whether the question is in the agent's remit before the answering model runs. The screen is itself a model call, on a cheaper model, so a declined question still reaches a provider — it does not reach your library.
The library is navigated
The agent walks an index of your documents and opens pages by name. There is no embedding step and no vector store, so your library is not copied into a second representation held somewhere else.
The model is called
Through OpenRouter on our account, or through your own provider key if the workspace has one. That choice decides whose contract the content travels under.
Guards run on the answer
Deterministic rules applied to the finished text, each recorded by name with its reason. No content leaves for a third-party scoring service.
The response carries its own evidence
A decision — answered, declined or escalated — the pages it opened, the guards that fired, and the usage that will bill. The same number your invoice is built from.
The one hop out of our infrastructure can be yours instead.
Point a workspace at your own provider key and inference is billed to you directly, at whatever rate you have negotiated. More importantly for this page: the question text and the retrieved library content then travel under your contract with that provider, on your terms. Either way, every request still asks for no training on prompts and zero data retention; your own settings can only add to that, not remove it.
We take no share of model spend in either arrangement. When you do not supply a key it is passed through at what it cost us, which is the only reason our own route exists.
The distinction that matters is between the content of a question and the metadata about answering it. Only the first is sensitive, and only the first has a clock on it.
This is the only switch that decides whether end-user content is written down here at all. Seven days is a debugging window, not an archive; a deployment that must never store question text sets it to zero and nothing is written.
Model, timing, token counts and cost per call. It is what the monitoring screens and the cost accounting read. It is metadata about a call, not the content of one.
It is the billing record and the only one. The number a turn is metered on is the number you are invoiced for, which is why there is no separate counter that could disagree with it.
Documents are files in a tree you control. Removing one removes it — there is no embedded copy in a vector store to go stale or to be missed on deletion.
What we hold, and what we do not
Underway and not yet complete. We are not certified today, and we would rather say that plainly than describe it in a way that reads as though we were. If your process needs a report before you can proceed, tell us where you are in your evaluation and we will tell you honestly whether our timeline can meet it.
What can be said without an auditor: the console is behind Cognito at the load balancer rather than in application code, the database is not publicly reachable, secrets are held as encrypted parameters rather than in the image or the task definition, and tenant API keys are stored hashed so the plaintext exists only at the moment you create one.
Questions this page did not answer?
Security review questions get a written answer from someone who has read the code, not a questionnaire response assembled from a template.