Data retention policy
Octagon retains customer‑provided data only for as long as it is necessary to deliver service or comply with law. Operational logs (API request/response metadata) are held up to 30 days, then truncated or aggregated; backup snapshots are encrypted and cycled every 90 days before cryptographic destruction. These limits reflect the “data‑minimisation + retention‑clause” best practice recommended by GDPR/CCPA guidance
Data archiving and removal policy
When a customer account is closed, content is soft‑deleted immediately, held for 30 days in cold storage (to allow accidental‑deletion recovery), then hard‑purged from primary and backup media within 60 days total.
Data storage policy
All production data are stored in AWS US‑East‑1/US‑West‑2, encrypted at‑rest with AES‑256 and in‑transit with TLS 1.3. Encryption keys are managed in AWS KMS with customer‑specific CMKs for Enterprise plans.
App/service has sub-processors
no
App/service uses large language models (LLM)
yes
LLM model(s) used
OpenAI GPT‑4, Grok, Qwen, and Llama
LLM retention settings
Raw prompt & completion pairs live 7 days for debugging, then are hashed and stripped of PII; aggregate telemetry retained indefinitely.
LLM data tenancy policy
Logical single‑tenant per customer; prompts & completions stored in segregated schemas/buckets. No training on customer data unless the customer explicitly joins a feedback programme.
LLM data residency policy
Default inference in AWS US (us‑east‑1 / us‑west‑2). EU or APAC sub‑accounts available for Enterprise plans.