Data handling (draft)

Stored data​

• Accounts and hashed passwords.
• Hashed session tokens and API key hashes.
• Agent definitions.
• Session events, including user messages and tool inputs and outputs.
• Agent memory: the seeded template for each memory scope, and any notes an agent writes about the end user it is talking to.
• Audit rows.
• Bami conversations, stored separately from tenant sessions.

Storage location​

Pantheon stores this data in PostgreSQL on Alethi infrastructure.

Agent memory​

An agent keeps notes separate from the conversation transcript, and the seeded template asks it to record the preferences of the person it is talking to.

Today those notes live with the session sandbox and are lost when it is recycled. Durable cross-session memory is wired but not switched on: the only rows in the durable store are copies of the stock template, one per scope, written when a scope is first used. Nothing an agent learned about an end user has been written to it. The scope rule below already applies to the durable store.

Those notes are scoped to one end user: to the tenant user when the session names one with user_id, otherwise to that single session. They are never shared across a workspace and never cross workspaces.

They have no expiry. GET /v1/users/{user_id}/memory and GET /v1/sessions/{session_id}/memory report what is held; the matching DELETE removes it. Deleting a session or a tenant user removes the memory scoped to it. Every erase that removed something is recorded in the workspace audit log as memory.erased, with the scope and a count and never the text.

Compacting a long conversation does not remove memory. The transcript is summarised; the notes are re-sent to the model in full on every call and are removed only by an erase.

See Agent memory for the builder guide.

Retention​

Agent and session data are retained until the tenant deletes the agent or session. Agent memory is retained until it, its session, its end user, or the workspace is deleted. Backups are kept per release.

Retention periods for accounts, credentials, audit rows, and release backups remain to be confirmed.

Bami conversations​

Bami conversation retention is pending counsel review.

Do not treat proposed retention periods as an established legal guarantee.

This page will publish the approved sentence after implementation and counsel review.

See Bami for how conversations are separated from tenant sessions.

Access​

Alethi operators can access stored data for support. Limit the private data you send in messages and tool results.

Bami support reads require your consent, unless a documented legal duty compels access.

See Support for questions about stored data.