---
title: "Privacy and data"
description: "What openshield stores and what it never stores, where, and for how long."
canonical_url: "https://openshield.dev/docs/privacy-and-data"
---
# Privacy and data

> What openshield stores and what it never stores, where, and for how long.

This page summarizes how data is handled. The [privacy policy](https://openshield.dev/legal/privacy), the [data processing agreement](https://openshield.dev/legal/dpa) and the [list of sub-processors](https://openshield.dev/legal/dpa#annex-sub-processors) are the binding texts.

## Your content is never stored

Images and texts are checked in memory and forgotten when the answer is sent. There is no copy, no thumbnail, no excerpt and no hash of them, in logs or anywhere else. Nothing holds your content in a queue, and it is not used to train models.

On paid plans, the [advanced AI workflows](https://openshield.dev/docs/texts#advanced-ai-workflows) also send a text that the first check sends to review, with its `context`, to a sub-processor in the United States. The [privacy policy](https://openshield.dev/legal/privacy) says who it is and what it keeps.

For the personal data your content may hold, Sway SRL is your **processor**: it processes the content only to return the decision, on your instructions.

## What is kept

<table>
<thead>
  <tr>
    <th>
      Data
    </th>
    
    <th>
      Holds
    </th>
    
    <th>
      Kept
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      The decision journal
    </td>
    
    <td>
      For each check: the time, the request id, the key, the kind, the workflow and its version, the decision, the reasons with scores and thresholds, the duration, the size and your <code>
        ref
      </code>
      
      . Never the content.
    </td>
    
    <td>
      7 days on the free plan, 30 days on paid plans
    </td>
  </tr>
  
  <tr>
    <td>
      Usage counters
    </td>
    
    <td>
      Checks per hour, key, workflow and kind.
    </td>
    
    <td>
      While the organization exists
    </td>
  </tr>
  
  <tr>
    <td>
      Account and organization
    </td>
    
    <td>
      Email addresses, names, members and roles, plan, workflows, keys (as hashes only).
    </td>
    
    <td>
      While the organization exists
    </td>
  </tr>
  
  <tr>
    <td>
      Dashboard sessions
    </td>
    
    <td>
      For each browser signed in: its IP address, its browser and when it signed in.
    </td>
    
    <td>
      Until the session expires or you sign out
    </td>
  </tr>
  
  <tr>
    <td>
      Audit log
    </td>
    
    <td>
      Who changed what in the dashboard, with the network prefix of their IP address (IPv4 /24 or IPv6 /48), never the full address.
    </td>
    
    <td>
      While the organization exists
    </td>
  </tr>
  
  <tr>
    <td>
      Billing
    </td>
    
    <td>
      Handled by Stripe; invoices are kept as accounting law requires.
    </td>
    
    <td>
      See the privacy policy
    </td>
  </tr>
</tbody>
</table>

The journal never stores the IP address or the browser of your users, only what you send in `ref`.

## Where it runs

- The databases and the file storage are in the **European Union**.
- The checking server is in the European Union.
- The website, the dashboard and the front door of the API are delivered through Cloudflare's network, so a request is handled in the Cloudflare location closest to the sender.

## Your data, your exit

You can export your workflows (JSON), your journal (JSONL or CSV) and your usage (CSV) at any time from the dashboard. When you delete your organization, the keys stop at once and your data stays available for 30 days so that you can take it out, then it is erased.

## Questions

Write to [contact@sway.events](mailto:contact@sway.events).


## Sitemap

See the full [sitemap](https://openshield.dev/sitemap.md) for all pages.