Docs / Security & access
What the platform holds for you
An honest list of what is stored, in what form, for how long, and what happens to it when you leave. Every line is held against the databases’ own schemas by the product’s suite, so a new table cannot be stored nowhere and mentioned nowhere.
Sealed
Registered secrets — a connection’s token or password, a mail account’s password, an endpoint’s signing secret, a person’s second-factor secret — are entered once, encrypted at rest, and bound to their tenant, environment, entity kind and field. Ciphertext copied from elsewhere does not open. No screen, command, diff or recorded request returns a value; the part of the platform you author in has no path that reads a secret back, and the only place one is opened is the key-rotation pass, which re-encrypts inside itself.
Plain
Scripts, configuration, version snapshots, run records and logs, the integration store (id mappings, state, datasets), stored files and staged data are stored in plain form on the volume. Sessions and tokens are stored as records a reader cannot present — what a session and a token are, and who may hold one, is on People and access. Encrypting the disk is the operator’s job, and the installation guide names it as a precondition for production.
For how long
| What | Kept |
|---|---|
| Configuration and its versions | for as long as the tenant exists |
| The record of who changed what | never pruned by age |
| The record of what ran (audit) | 365 days |
| Run rows | 90 days |
| Archived runs | 7 days; failed ones 30 days |
| Hot log lines | 24 hours, then with the archived run |
| A debug run’s trace | 7 days |
| Dead letters | 7 days |
| A stepped run waiting for your move | 1 hour |
| Files and staged data | until you delete them, or a store’s own ceiling evicts |
Two trails
Both audit trails are append-only and hash-chained: a changed or removed row is detectable. Policy switches — allowed egress ranges, write probes — are recorded at the moment they change, with who changed them.
When you leave
Deleting a tenant removes configuration, history, credentials, runs, files and staged data on every machine of the installation, and is reported finished only when every machine has confirmed. The two trails survive. A backup taken before the deletion restores the tenant whole; ageing it out is the operator’s, on the schedule the beta terms state.