Skip to content

ADR-0019: Data residency, classification, retention and tenant ownership

Decision

This page records a decision and its status. A Proposed decision is not binding; an Accepted decision is binding on the Factory until amended or superseded.

  • Status: Accepted 2026-10-09 by the product owner (decision D31; closes Q-09 and Q-10)
  • Date: 2026-10-09
  • Deciders: Dmitry Khaymov (product owner)
  • Tags: privacy, residency, retention, export, deletion

Context

The Factory processes customer source code, documents and generated artifacts, and its logs could carry prompts and outputs. Residency, retention and deletion were open questions (Q-09, Q-10).

Decision

  1. Residency: tenant-selectable Azure region (default West Europe, Israel Central available); all tenant stores, sandboxes and indexes in that region; content processed only by approved model deployments whose region and privacy class satisfy tenant policy; PII-classified content only on private profiles.
  2. Classification: public, internal, confidential, restricted; model fields carry pii and classification; redaction in every projection and notification.
  3. Telemetry: no raw prompt, response or tool-output logging by default; traces and logs 30 days; audit evidence 7 years, redacted, immutable.
  4. Retention: runs and artifacts 1 year by default, tenant-configurable; knowledge and memory deleted with their source and with the tenant; usage records 7 years.
  5. Ownership: the tenant owns everything it submits and everything derived; export in open formats on request; deletion within 30 days including derived indexes and promoted memory; ownership transfer is an audited export–import.

Consequences

  • Positive: every service page can state residency and retention from one rule; the Studio can show honest data-handling to customers; hybrid and on-premises profiles follow naturally.
  • Negative: region-bound processing limits model choice for restricted content; derived-data deletion requires lineage from source to chunk to memory (BC-10, BC-12, BC-13).

Alternatives considered

Alternative Why not chosen
Single region for all Blocks customers with residency obligations
Keep derived learning after deletion Conflicts with tenant ownership and with D32 learning governance