47PLATFORM SECURITY

Privacy, Retention & Data Residency

Collect the least content needed to secure and explain the agent workflow.

Priority: P0
Phase: Foundation
Primary owner: Privacy / Platform
Status: Blueprint

Objective

Agent telemetry may contain prompts, customer records, proprietary code and regulated information. Privacy controls must be configurable from day one, including the ability to operate with metadata-only telemetry for sensitive customers.

What to build

Per-tenant and per-data-class retention periods.
Regional data residency options for control-plane data where commercially justified.
Prompt/content capture modes: full, redacted, hashed, metadata-only.
Deletion/export workflows for supported privacy requests and customer offboarding.
Sensitive-field classification and minimization.

Implementation decisions

Keep operational metadata separate from content payloads.
Default to not storing secrets; aggressively redact credentials.
Document subprocessors and cross-region flows.
Use customer-managed keys as an enterprise option where needed.

Definition of done

Tenant can prove retention policy configuration and deletion completion.
Changing capture mode affects new telemetry predictably.
No raw secret is intentionally retained in ordinary logs.

Success metrics

Content capture distribution
Retention-policy compliance
Deletion SLA
Regional tenant count

PRIVACY BY DESIGN

Collect the least content needed to secure and explain the agent workflow.