Data & privacy
Two surfaces already draws the boundary; this page is about what stays on which side of it, and the two ways you can get your own data back out.
Your conversation history lives only on your Stack
Every Thread's Event journal, and the git history in the Workspaces your Runs execute in, exists only on your own Stack. The control plane never receives it, is never proxied a copy of it, and has no code path that could reach it — it only ever holds the account/billing facts described in Two surfaces.
Credentials never leave your Stack, and never enter the journal either
Your Runtime Credentials — whatever you connected under Auth & consent — are deliberately excluded from the append-only Event journal itself, and they never travel to the control plane. The only thing that ever rides in your Stack's own status reporting is a closed health reading (valid / invalid / not yet provisioned) per Credential — never the credential's value, and never anything freeform that could carry one by accident.
Automatic backup is for disaster recovery, not for browsing
Your journal is copied daily, encrypted with a key only your tenant and the control plane hold, to object storage on a provider deliberately separate from your Stack's own compute provider — so a single compromise can't reach both. This exists purely so a destroyed or corrupted Stack can be rebuilt and re-fed its own history; restoring is always rebuild-and-refeed, never an edit applied to a Stack that's still running. It is not a download you'd reach for on your own — that's the export archive, next.
Getting your own copy: the export archive
From your own Dashboard, on demand, you can download an export archive of your data — unlike the automatic backup, this one is unencrypted (it's you, over your own already-authenticated session, pulling your own data) and it never routes through the control plane at all.
Closing your account doesn't silently destroy work
Decommissioning refuses to tear down your Stack's infrastructure while it holds an Unshipped attempt — a Run whose commits never reached your remote — unless you explicitly confirm you want to proceed anyway. That confirmation is a deliberate, recorded decision, never an assumption made on your behalf.
Related
- Two surfaces — the control-plane/Stack boundary this page describes what stays on each side of.
- Auth & consent — how a Credential gets onto your Stack in the first place.