Data Policy
This document is a draft and not yet in force.
Core Principles
Arnesa operates under strict data boundaries: credentials never enter sandboxes, logs, or databases, and the outcome ledger is tamper-evident and append-only.
Studio BYOK Data Handling
API Keys and Credentials
Your API keys are held only in the worker's RAM, deleted when the run ends and in any case after at most 30 minutes. Keys never touch disk, database records, persistent queues, or execution sandboxes.
Content Retention and Purging
Prompts, notes, and task artifacts are kept for up to 30 days by default, and may be deleted after 7 days while capacity is limited, after which a nightly job permanently deletes them. You can also delete them immediately from the run page at any time.
Fields Recorded for Community Insights
While the data-sharing switch is on (you can turn it off before starting a run), only the following coarse metadata fields are stored in the outcome ledger:
- A random 128-bit unguessable run reference token
- Model identifier and normalized model family
- Task category or repository primary language and size bucket
- Terminal run status (succeeded, failed, cancelled)
- Coarsened run duration, total token counts, and estimated cost
Data We Never Collect
We never store raw API keys, private source code, request/response payloads between Studio and your model provider, or exact prompts after deletion.