Data protection
Classification, encryption, retention, deletion, residency, export and ownership across the whole life of the data.
Four classes, and which of your data falls into each
| Class | Contents | Handling |
|---|---|---|
| Public record | Events, entities, observations and graph edges derived from 55 public feeds — the great majority of what we hold | Served under the licence of its source. Every record carries its publisher, its licence and both timestamps: when the source published it and when we first saw it. |
| Licence-restricted record | Records from sources whose terms do not permit republishing them individually | Ingested and used for analysis; never served as an individual record and never included in an extract |
| Customer business record | API key digests, request logs, contact details, contract and billing records | The only class in which a customer is identifiable. Protected by row-level security and reachable only by the privileged role. Not shared with anyone. |
| Operational data | Source run records, job health, cached responses, integrity check findings | Internal, summarised publicly on status |
There is no customer content class today, because the product holds none. When the enterprise workspace introduces one it becomes the most protected class here, and this page will be updated before it ships.
Three classes of source, enforced in code and in the database
| Class | Sources | Served as records | In a bulk extract |
|---|---|---|---|
| Open | 46 | Yes | Yes |
| Non-commercial | 7 | Yes, with the licence attached to every record | No |
| Internal | 2 | No — neither events nor observations | No |
Figures measured 7 September 2026 and readable from
/api/v1/licences, which reports the same numbers from the running
system alongside the count of restricted records held and the count publicly
visible, which is zero.
How it is enforced:
- The class is a required field on every source definition, so a new source cannot be added until its licence has been read and recorded.
- The filter is implemented in the shared query builder rather than at each endpoint, so a new endpoint cannot omit it.
- The database enforces it independently, with its own flag and its own condition, so an application error does not defeat it.
- An automated check probes for leakage and alerts if it finds any, and the code and the database are compared against each other on every operations report.
Algorithms by state
| State | Protection |
|---|---|
| In transit, public | TLS 1.2 minimum, TLS 1.3 preferred. HSTS for one year including subdomains. HTTP is redirected and never served. |
| In transit, internal | TLS over Cloudflare's private network; TLS 1.3 plus a shared secret to the database function |
| At rest, database | AES-256, including backups and replicas |
| At rest, object storage | AES-256 |
| At rest, secrets | Encrypted in the platform secret store, not readable back |
| API keys | SHA-256 digest. The key is never stored, so a copy of the database yields no usable credential. |
| Endpoint devices | Full-disk encryption, screen lock |
Key management is performed by the platforms. We do not operate a key hierarchy of our own. Customer-managed keys are not offered.
How long each class is held, and why
| Data | Retention | Reason |
|---|---|---|
| The public record — events, entities, observations, graph | Indefinite | It is the product. A disruption archive that forgets cannot support the correlation and backtesting the system exists for. |
| Record revision history | Indefinite | Provenance. Any figure must be traceable to the fetch that produced it, including a figure that later changed. |
| API request logs | 12 months | Billing, abuse handling, incident reconstruction |
| Source run records | Rolling window | Operational health |
| Cached responses | Seconds to hours | Performance. Not a system of record. |
| Database backups | 7 days standard, 28 days on enterprise | Recovery. See business continuity. |
| Webhook alert rules | Until deleted, or 120 days after the last delivery attempt or save | So that an unowned rule does not continue firing |
| Contract and billing records | 7 years | Statutory tax and accounting retention |
What can be deleted and how quickly
- API key records: revoked immediately on request; the record is deleted at the end of the contract, subject to statutory retention on the billing record.
- Webhook alert rules: deleted immediately on request, or by you at any time from the Terminal.
- Contact details: deleted on request, subject to the same statutory retention.
- Request logs: expire on the 12-month schedule and can be purged earlier on request.
- Deletion completes within 30 days of a verified request, across primary storage and caches. Data in backups is removed as those backups age out of the retention window; backups remain encrypted and access-controlled throughout.
The public record is outside the scope of a deletion request: it is not customer data and it comes from a published source. Where a source corrects or withdraws a record, our copy carries the correction with its revision history intact.
Media disposal is performed by the infrastructure providers, whose attestations cover secure disposal. See subprocessors.
Where data is processed
| Data | Location |
|---|---|
| The analytical database and its backups | AWS us-east-2, United States (standard);
EU region available on enterprise agreements |
| Cached responses, extracts, coordination state | Cloudflare's global network, cached at the location nearest the reader |
| Model inference | Cloudflare's network; text does not leave it |
| Source control | United States. Never holds production data. |
Vaethra Technologies LLC is established in the United States, so for a customer in the EEA or the UK we are the data importer: transfers are covered by the 2021 Standard Contractual Clauses, incorporated in the DPA together with the supplementary measures set out there. Both infrastructure providers maintain their own transfer mechanisms.
EU data residency is available on enterprise agreements. The database platform supports EU regions; where residency is a requirement, it is agreed at contract and the database is provisioned accordingly.
Who owns what, and how you obtain a copy
- You own your data. Anything you provide — contact details, alert rules, and in the enterprise workspace your own facilities and routes — remains yours. We claim no licence over it beyond operating the service, and we do not use it to train anything.
- The public record is licensed rather than owned. It comes from
public sources under their own terms, and what you may do with it is set by
those terms, which travel with every record in a
licensefield. We cannot grant rights the upstream publisher did not grant us. - Export is a standard feature. The API returns JSON and CSV, bulk extracts are pre-built files, and the OpenAPI document is public. There is no export fee and no exit fee.
- On termination, a complete export of anything you supplied is provided within 30 days on request, in a machine-readable format.
- We do not sell, share, rent or broker data. There is no advertising, no analytics broker and no data broker anywhere in this business.