Data handling
Tenant separation
Section titled “Tenant separation”Every record belongs to one organisation. A request for another organisation’s object behaves as if it does not exist.
What is stored
Section titled “What is stored”| Data | Purpose | Kept |
|---|---|---|
| Conversations and files | Your history | Until deleted or removed by retention |
| Sandbox snapshots | Resume your work | Up to the retention ceiling; 0 keeps none |
| Memory | Remembered facts and processes | Until you delete it, or the member is removed |
| Audit log | Accountability | Kept after a member is removed |
| Connector tokens | Act on your behalf | Encrypted at rest; deleted on disconnect or removal |
What leaves the platform
Section titled “What leaves the platform”- Models: requests go to Mistral models.
- Web search is off by default, enabled per organisation. Only the search query leaves, and it is sent to Mistral’s global API endpoint.
- Read aloud: when someone uses it, the text of that answer is sent to Mistral’s speech service. Code, tables and link addresses are not read.
- Connectors reach only the services you connect.
- Sandbox internet is off, limited, or full, per organisation.
Encryption at rest
Section titled “Encryption at rest”Connector tokens and shared keys are encrypted by Lucy before they are stored. Encryption at rest of conversation data, files and saved sandbox workspaces is under review. See Encryption and secrets for the current status.
Deletion
Section titled “Deletion”Retention sweeps run hourly. Removing a member deletes their conversations, files, sandboxes, memory, devices and preferences.