Data retention policy
Data is retained for the duration of a customers’ contract with Common Room, and is partitioned by customer. We currently do not have customer-specific data retention policies, but can securely wipe all data upon termination of contract if requested by the customer.
Data archiving and removal policy
As a Data Processor, Common Room supports anonymization via wiping user emails and other identifiers, which in turn unlinks the content generated by the user from being attributed to the anonymized member.
This can be accomplished in two ways:
In-product, using the “Permanently anonymize” option on a contact’s profile page, and
Via API, using our Right To Be Forgotten/Anonymization endpoint that can be used to forward removal requests from your customers, by integrating directly into your existing compliance tooling. Documentation for the API can be found at https://api.commonroom.io/docs/community.html
For platforms which support these capabilities natively, Common Room listens for anonymization events and automatically propagates them to our system (ex: Discourse publishes an event when a user chooses to delete/anonymize their account, and we process this event to wipe the user’s identifiers in our system).
Common Room is also directly integrated with privacy and compliance management tools like Transcend, if your organization uses it.
For data where Common Room is the data controller (ex: Prospector), end consumers can request removal of data via submitting information at https://app.commonroom.io/remove-my-info. Data will be removed going forward from Common Room’s prospector database within 30 days of submission.
In addition to the above, we can securely wipe all data if requested by a customer via native support when available with source platforms or via our Right-to-be-Forgotten API (https://api.commonroom.io/docs/community.html#tag/Right-to-be-Forgotten). Data storage policy
Common Room stores Customer Data in AWS (US-West-2 region). All data is logically partitioned by customer, encrypted at rest with AES-256, and encrypted in transit with TLS. Structured data (primarily user information) is stored in Postgres on RDS, and content such as messages, responses, and topics is also stored in RDS. Data is retained for the duration of the customer's contract and can be securely wiped upon termination if requested. We can provide a data flow diagram for more detail on request.
Data center location(s)
United States
Data hosting details
Cloud hosted. Common Room runs on AWS infrastructure in the US-West-2 region, with data logically partitioned per customer.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
OpenAI and Anthropic LLMs. Various versions depending on the task
LLM retention settings
Zero Data Retention. Common Room has a contractual ZDR agreement with its LLM providers.
LLM data tenancy policy
Data sent to LLM providers is not pooled across customers and is not used for model training. Common Room has a Zero Data Retention (ZDR) agreement with its LLM providers, so neither Common Room nor the LLM provider retains customer data.
LLM data residency policy
Common Room does not persist customer data with LLM providers. Under our Zero Data Retention agreement, prompt data is processed transiently for inference only and is not stored by the LLM provider, so there is no LLM-side data residency footprint.