Settings, operations & compliance
Security & privacy
Settings → Security & privacy gathers everything that makes a deployment trustworthy: the tamper-evident audit log, automatic retention, a generated processing manifest (GDPR Art. 30), erasing a person's or a document's data (Article 17), and exporting everything held about a person (Article 15). Green means working — none of it needs day-to-day attention.
| Erasure (Art. 17) | Removes a person's conversations, or one document, everywhere — index included. A hard delete, itself recorded in the audit log. |
|---|---|
| Subject export (Art. 15) | Everything stored about a person — account, conversations, audit trail — as a JSON file they can be handed. |
| Compliance manifest | The processing record (purposes, retention, sub-processors, security measures) generated live from the running configuration, so it can never drift from reality. |
| Deployment configuration | Read-only view of the .env settings this deployment runs with. |
Retention, in practice
Conversations and audit events each carry their own retention period, set once in the deployment's configuration and shown here read-only rather than editable — a deliberate choice, so the compliance manifest always describes what the deployment actually does rather than a setting an admin could quietly change afterwards. A nightly job deletes anything older than its period; the Security & privacy tab shows when that job last ran.
Where data lives
Documents, the index, conversations and the audit trail all live in this deployment's own database — never in a shared store across customers. Documents themselves are fetched from your sources over an encrypted connection and held only as far as this deployment's own retention allows.
Fully self-contained, on-premises answering — every step of a question handled inside the deployment with nothing relayed out — is on the roadmap, not available today; the compliance manifest describes exactly what the current deployment does, not a future mode.
Last updated 20 Sep 2026