# Data location and retention

> **Note:** The retention periods are the Telltale server's defaults (see [Server API and recovery](/docs/server)).
> Where each kind of data lives is in the table below.

Telltale **detects AI agents, not several people sharing one login**. What it keeps is session evidence and verdicts,
not content people type or see.

## Where

| What | Where |
|---|---|
| Database: all customer and account data, including backups | Supabase, AWS us-east-1 (N. Virginia, USA) |
| Processing: the Telltale server | Amazon Web Services, us-east-1 (N. Virginia, USA): one Amazon ECS (Fargate) container at launch behind an Application Load Balancer and Amazon CloudFront (TLS and pass-through, no caching), in Telltale's own AWS account. Server secrets are in AWS Secrets Manager and container logs in CloudWatch Logs (30 days), both in us-east-1. It reaches the database through Supabase's session pooler in the same region |
| Account emails in transit | Supabase's built-in sender today. Resend is planned once Telltale has its own email domain (region not chosen yet) |
| Marketing site | Vercel edge network (no customer data) |

There is no EU region at launch. An EU deployment (Supabase and AWS eu-central-1) is possible later as a separate
installation; data doesn't move between regions.

## How long

Defaults; a workspace owner or admin changes four of them per Site in Settings › Data & privacy: sessions, decisions,
usage and the audit log (1 to 400 days each; usage keeps at least 90). Shorter is better for privacy. Separate count
ceilings per Site (per workspace for the audit log) protect the disk; when one removes rows early, the oldest kept time
is recorded and reports say their data starts there. Security-relevant audit entries and chargeable rows are never
removed by a count ceiling, only by age.

A plan's history window (Free 7 days, Starter 30, Growth 90, Enterprise by contract) is how far back the dashboard's
usage views reach, and it is also how long **sessions with AI agent activity** are kept, so every agent session behind a
7, 28 or 90-day view is still there. A session counts as one with AI agent activity once any of its verdicts read AI
agent (a handover included), and it is never kept for less than the Site's session setting. Human-only sessions keep the
short session retention (8 days by default). Enterprise keeps agent sessions as long as the contract says, else as long
as the Site's usage records (90 days by default), at most 400 days. Moving to a smaller plan deletes nothing early: the
longer period still applies until the sessions it kept have aged out, then the new plan's period applies. Every other
period is in the table below, whatever the plan.

| Data | Default | Notes |
|---|---|---|
| Raw behaviour samples (timing, pointer positions) | 7 days at most | The operator can set less (`TELLTALE_BEHAVIOUR_RAW_MINUTES`); per Site: 1 hour, 1 day or 7 days, never more than the operator's limit |
| Page request shapes (discovery, page-HTTP lane) | 1 hour | Shapes only, never values |
| Daily behaviour summaries | 2 days | |
| Sessions and their verdicts (human-only sessions) | 8 days | Follows the Site's session setting |
| Sessions with AI agent activity (the same shapes as any session: no typed content) | The plan's history period: Free 8 (the session default), Starter 30, Growth 90; Enterprise by contract | Never less than the Site's session setting; at most 400 days; a consent withdrawal still keeps at most 8 days. Activity cursors (which minutes a session already counted) follow this period |
| Connection network type (for example "Connected from a cloud provider (AWS)" or "privacy relay") | With the session | Only the category and the provider's name. The IP address it came from is used while the request is handled and then discarded: never stored, logged, hashed or returned |
| Detector decision history | Off; 1 day when a test server turns it on | Never on a public deployment |
| Usage records for billing, agent minutes, activity minutes | 90 days | Follows the Site's usage setting (at least 90). Erased subjects leave an anonymous tombstone so a retried event isn't charged twice |
| Session-to-account links | 90 days | Kept as long as the longest of the Site's session, agent session, decision and usage periods |
| Daily session counts, approved-route calls (including MCP server calls), MCP agent sessions | 90 days | Fixed. MCP calls are shapes only: tool name, timing, outcome category, the declared client name, your account and user IDs and a hashed session key; never arguments, results, error text or headers |
| API channel: per-day route counts (`apistat`), agent API sessions (`apisession`) | 90 days | Fixed. Route counts have no identity: method, route template, calls, status classes, timing, size buckets, network labels. Agent API calls are approved-route calls (above). Never bodies, query values, headers or tokens; the client address and signature headers are used once at ingest and never stored |
| API channel: batch replay markers (`apibatch`) | 2 days | A batch ID and a count, so a resent batch is counted once |
| API channel: "Is it working?" state (`apisource`) | While the Site exists | The last batch time, the middleware version and framework, call counts |
| "Agent said:" text (the opt-in why field for MCP tools) | 30 days | Only for tools you named, while "Understand what agents are trying to do" is on; at most 280 characters; turning it off or erasure removes it |
| Deep insights captures (`deepcapture`, opt in) | 7 days by default; 7, 14 or 30 (owner setting) | Only when the workspace owner turned Deep insights on for the Site, and only the MCP or API fields the customer's SDK lists; never headers, cookies, Authorization values, tokens, passwords or other credentials. Stored encrypted. Turning it off deletes them at once; erasure removes a subject's captures and subject export includes them |
| Agent-usage ledger: entries and their evidence | 90 days | Follows the Site's usage setting |
| Agent-usage ledger: daily totals per account | 400 days | Counts only; erasure removes an account's rows |
| Protected-action decisions, workflow trials | 90 days | Decisions follow the Site's decision setting |
| Notifications | 30 days | Follows the Site's decision setting when it is changed, at most 90 days |
| Tool executions (non-chargeable), webhook deliveries, evaluations, tool wording suggestions, scoped agent tokens, account-alert Slack deliveries | 30 days | Chargeable tool executions keep the usage period |
| Audit log | 30 days | Per workspace; follows the longest audit setting of its Sites |
| Shared `/try` run links | 1 hour | Held in the server's memory only, never in the database |
| Workspaces, Sites, members, settings | Until deleted, then 30 days | Owners delete Sites and workspaces in the dashboard; both can be restored for 30 days (below) |
| Account (email, sign-in links, two-step factors) | Until the person deletes the account | Telltale removes its own rows at once and asks Supabase to delete the identity in the same step; if Supabase can't be reached it retries (from 1 minute, backing off to every 6 hours) until it is gone |
| Emails given on an earlier version of `/try` (the demo no longer collects any) | Until the person asks us to delete it (no fixed end yet) | Only the email, the consent wording's version and a confirmed flag; stored apart from telemetry and visible only to the operator |
| Database backups | 7 days (Supabase Pro daily backups) | Supabase's daily backups; point-in-time recovery, if turned on later, would change this period |

## Telltale's own sign-up page

Telltale's own **Create account** screen runs Telltale's own tag, the same hosted tag customers install, when the operator
sets `TELLTALE_SIGNUP_TAG_KEY` ([Server API and recovery](/docs/server)). It records only; it never blocks, holds or
slows a sign-up, and the sign-up never asks for the verdict.

- **What:** the same shapes as any session (timing and kind of input, automation traces), never what is typed: no email
  address, no password, no field values. Sign-up requests are on sensitive routes, which the tag never observes. The
  session is not linked to the account that is created (no identify call).
- **Where it goes:** to one internal Telltale Site in Telltale's own internal workspace, in the same database and region
  as everything else (above). It is never a customer's Site and never shows in, or counts toward, any customer's
  workspace, reports or bill. No new subprocessor is involved.
- **When:** only while the Create account screen is open. Leaving it (to Sign in, or once the account is created) stops
  the tag on that page.
- **How long:** the internal Site's own retention settings, the defaults above unless changed.

## Deleting before the period ends

- **One user or account:** Settings › Data & privacy › erase by user ID and/or account ID removes every session and
  record tied to it, including rows recorded before the identity was known. Export first if the person asked for a
  copy (GDPR article 15).
- **A Site:** an owner deletes it in Settings › Data & privacy. At once it stops collecting: its tag and keys are refused,
  it leaves the site list and every view, its webhooks, scheduled reports, exports and forwarding stop, and pending
  webhook deliveries are cancelled. Its records are kept for a **30-day safety window**, under the Site's own retention
  settings: a banner at the top of the dashboard says "Pending deletion: restore or export until <date>", and the owner
  can restore the Site as it was, download its usage and report CSVs, or delete it for good at once ("Delete now", typing
  the name again). When the 30 days end, the Site's settings, sessions, usage and other records are removed in short
  batches by the background passes. Each step is in the audit log (deleted, restored, permanently deleted).
- **A workspace:** an owner deletes it once it has no live Sites. Its members lose access at once; for 30 days the owner
  can restore it from the banner in their other workspace, then its memberships, invitations, plan and audit log are
  removed.
- **Erasure is never delayed by these windows.** Erasing one user or account (above) takes effect at once, also on a
  Site in its 30-day window, and deleting your own Telltale account removes the workspaces it leaves empty at once,
  with their Sites' records.
- **Consent withdrawn in the browser:** the script stops and ends the session; the server discards the session's raw
  behaviour batches, detector history, self-declared labels and queued webhook deliveries. The ended session keeps only
  the default 8 days, even where the Site keeps sessions longer (agent sessions included). Erase by user or account ID
  to remove it sooner.
- **Where deleted bytes go:** on Postgres a deleted row is unreadable at once and its space is reclaimed by autovacuum;
  copies can remain in the write-ahead log and in backups until those roll over (at most the backup period above).