Skip to content

Data governance

Decision

This page records a decision and its status. A Proposed decision is not binding; an Accepted decision is binding on the Factory until amended or superseded.

Decided on 2026-10-09 (ADR-0019; D31). Applies to every Factory store and projection; generated products apply the same rules through the SaaS templates for their own tenants.

Residency and processing location

  • Each Factory tenant selects an Azure region at onboarding; the default is West Europe and Israel Central is available. All Factory stores of that tenant, its sandboxes and its indexes live in that region; a change of region is a migration with an audit trail, never a silent move.
  • Customer source code, documents and artifacts are processed only in the tenant's region and by approved model deployments whose region and privacy class satisfy the tenant policy. Content classified as restricted or carrying PII may use only pii-local or equally private profiles (hybrid compute).
  • Hybrid and on-premises profiles keep customer data in the customer environment; the ConnectSoft control plane holds scope ids, run state, approvals, usage and hashes, never content.

Classification

Class Examples Handling
public Published documentation, marketplace listings No restriction
internal Run state, usage, metrics, project metadata Tenant-scoped; visible to the tenant's roles
confidential Source code, documents, artifacts, prompts and outputs, knowledge chunks Tenant-scoped; never logged raw; region-bound; model use per profile privacy class
restricted Credentials and secret references, PII fields, audit evidence Secret broker only; redaction in every projection; retention per the audit rule

Every entity field in the model may carry pii: true and a classification; ConnectSoft.Extensions.Compliance provides the classifiers and redactors; the Studio shows restricted and confidential content only with explicit scope and never in notifications.

Logging and telemetry

  • No raw prompt, response or tool output logging by default. Spans carry hashes, token counts, model and profile ids, policy receipts and sizes; content lives only in the artifact store under the tenant's classification.
  • Traces and logs are retained 30 days; metrics 13 months aggregated; audit evidence 7 years in redacted form in the immutable audit store.

Retention and deletion

Data Default retention Owner of the rule
Runs, steps, attempts, approvals, recovery journal 1 year, tenant-configurable (shorter or longer) Tenant policy (Workspace admin may shorten, Platform admin sets the ceiling)
Artifacts and their content 1 year, tenant-configurable; immutable while referenced by an unexpired run Same
Knowledge sources, chunks, embeddings, indexes As long as the source is approved; deleted with the source and with the tenant Same
Promoted memory Until revoked or expired per the promotion record; deleted with the tenant Same
Usage and cost records 7 years (commercial evidence) Platform policy
Audit evidence 7 years, redacted, immutable Platform policy

Tenant ownership: the tenant owns everything it submits and everything derived from it. On request, the Factory exports runs, artifacts, knowledge sources and memory in open formats (JSON for records, original formats for content, Markdown for reports) within the tenant's region. On deletion, all tenant data including derived indexes and promoted memory is removed within 30 days; audit evidence remains in redacted form for its own retention; usage records keep only what commercial evidence requires. Ownership transfer between tenants is an explicit, audited export–import, never a re-keying.

Learning from tenant data

Learning is tenant-scoped by default (D32): episodic memory, evaluation datasets and promoted memory stay inside the tenant. Promotion to a shared ConnectSoft memory requires a reviewed proposal and explicit tenant consent; nothing crosses tenants silently.