Trust & Security
Data handling
What Oconee Runtime processes, what it deliberately does not retain, and how storage, separation, retention and deletion work.
What Oconee Runtime processes
Governance metadata about AI activity: the kind of action an AI tool or agent attempted, the kind of resource it was directed at, the identity and agent responsible, the context that applied, and the decision policy returned. Alongside that, the account and operational data needed to run the service.
Why it processes it
To evaluate an action against an organization's policy at the point it is attempted, to return a decision, and to leave evidence that the decision can be reviewed against afterwards. Without the record there is nothing to investigate an incident with and nothing to show an auditor.
What it avoids collecting
Oconee Runtime is designed to capture the metadata needed for governance and evidence without unnecessarily retaining sensitive content. Prompt text, source code, secrets and credentials, clipboard contents and payment details are scrubbed from event payloads, background jobs, logs, exports and error reports before they are stored or transmitted.
Controls
How the data is held
Where a control is provided by our infrastructure providers rather than by Oconee directly, it says so.
Storage
Product data is held in managed PostgreSQL. Exports, archives and backups are written to object storage. Both run in the United States on managed infrastructure; the database and cache accept connections only from Oconee Runtime's own services and are not reachable from the public internet.
Encryption
Traffic is served over HTTPS/TLS. Stored data is encrypted at rest by the managed infrastructure it sits on, and credentials for connected services are encrypted with AES-256-GCM by Oconee before being written to the database.
Tenant separation
Every authenticated request resolves to an organization, and access is checked against that organization's membership on the server before data is returned. Data belonging to one organization is not served to another.
Retention
Retention is configured per data type rather than as one blanket window — activity records, policy violations, audit logs, exports and backups can each be set separately. Defaults vary by plan, and enterprise agreements can set custom windows. Retention varies by data type and service function; contact Oconee for current retention details for your configuration.
Deletion
When a retention window elapses, the data it covers is removed by a scheduled process rather than left in place. Legal holds can suspend deletion for specific data where a customer needs to preserve it. Deletion requests outside a configured policy are handled through your account contact.
Logging
Administrative and platform actions are written to an append-only audit log that the database refuses to modify or delete, chained with SHA-256 so that a removed or altered record is detectable. Application logs have sensitive values redacted before they are written.
Customer controls
Organizations control their own policy configuration, enforcement mode, retention settings, administrative access, user provisioning and audit access. Event data can be exported at any time, including in SIEM-ready formats, for retention in your own systems.
Reviewing data handling for a purchase?
We can provide a data-flow overview, retention configuration details and subprocessor information as part of a vendor review. See also the subprocessor list and the privacy overview.
Last updated: September 7, 2026