# Your data

URL: /systems/trust-and-governance/your-data · Id: `page:systems/trust-and-governance/your-data`

> Who owns the data in a Startup, where it lives, who can read it, how it leaves, and what erasure means when every record is kept forever.

The data a [Customer](/business/nouns/customer) puts into a [Startup](/business/nouns/startup) belongs to that Customer, in a [Tenant](/business/nouns/tenant) of its own. The Startup holds it to deliver what was bought, and for nothing else.

## Who owns what
| Data | Owner | Who reads it |
| --- | --- | --- |
| What a Customer writes, uploads or sends | The Customer | The Customer's own people, and the Startup's [Workers](/business/nouns/worker) for a stated [Purpose](/business/nouns/purpose) |
| The Startup's records, such as its [Orders](/business/nouns/order) and [Messages](/business/nouns/message) | The Startup's [Company](/business/nouns/company) | Its Workers, by [Role](/business/nouns/role) |
| The Startup's definition and history | The Startup's Company | Its owner, and auditors in scope |

A founder exports the whole Startup at any time: its definition, its records and every [Version](/business/nouns/version) of both.

## Isolation
Each Tenant is a partition of its own. Every query names the Tenant it reads, and no query crosses two. [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation) probes that boundary every day.

Data is [encrypted](/code/platform/encryption) at rest and in transit. An agent reads a Tenant only inside the [Task](/business/nouns/task) that needs it, through [task-bound access](/systems/trust-and-governance/controls/task-bound-access) that expires with the Task.

## No model learns from it
Tenant data never trains a model. It never feeds another Startup's prior, benchmark or [Experiment](/business/nouns/experiment), even a sibling's.

## Where it lives and for how long
A Startup declares its region through [Residency](/code/platform/residency), and every copy, replica and backup stays there.

Retention is set per Purpose. When a Purpose's retention ends, its records close to every reader that relied on that Purpose.

## Export
A Customer exports their whole Tenant at any time, as JSON and CSV, through the [Portal](/business/nouns/portal) or the API. [Import and export](/code/platform/import-export) defines the formats.

## Erasure
Records are kept forever, so erasure works by closing every door to a record. A request to erase becomes two things:

1. A [Suppression](/business/nouns/suppression), so no Startup in the Company messages the [Person](/business/nouns/person) again.
2. A read restriction, so no Worker, report, export or model reads the record again.

The [Event](/business/nouns/event) recording the request stays, and that is how the Startup proves it complied. [Privacy requests](/systems/trust-and-governance/controls/privacy-requests) tests every request against its legal deadline.

## Next
- [Subprocessors](/systems/trust-and-governance/subprocessors): the outside companies that process it.
- [Customer guarantees](/systems/trust-and-governance/customer-guarantees): every promise in one table.