Your data
Who owns the data in a Startup, where it lives, who can read it, how it leaves, and what erasure means when every record is kept forever.
The data a Customer puts into a Startup belongs to that Customer, in a Tenant of its own. The Startup holds it to deliver what was bought, and for nothing else.
Who owns what
| Data | Owner | Who reads it |
|---|---|---|
| What a Customer writes, uploads or sends | The Customer | The Customer's own people, and the Startup's Workers for a stated Purpose |
| The Startup's records, such as its Orders and Messages | The Startup's Company | Its Workers, by Role |
| The Startup's definition and history | The Startup's Company | Its owner, and auditors in scope |
A founder exports the whole Startup at any time: its definition, its records and every Version of both.
Isolation
Each Tenant is a partition of its own. Every query names the Tenant it reads, and no query crosses two. Namespace isolation probes that boundary every day.
Data is encrypted at rest and in transit. An agent reads a Tenant only inside the Task that needs it, through task-bound access that expires with the Task.
No model learns from it
Tenant data never trains a model. It never feeds another Startup's prior, benchmark or Experiment, even a sibling's.
Where it lives and for how long
A Startup declares its region through Residency, and every copy, replica and backup stays there.
Retention is set per Purpose. When a Purpose's retention ends, its records close to every reader that relied on that Purpose.
Export
A Customer exports their whole Tenant at any time, as JSON and CSV, through the Portal or the API. Import and export defines the formats.
Erasure
Records are kept forever, so erasure works by closing every door to a record. A request to erase becomes two things:
- A Suppression, so no Startup in the Company messages the Person again.
- A read restriction, so no Worker, report, export or model reads the record again.
The Event recording the request stays, and that is how the Startup proves it complied. Privacy requests tests every request against its legal deadline.
Next
- Subprocessors: the outside companies that process it.
- Customer guarantees: every promise in one table.