Data handling

Data categories

A governed workflow can involve several different data classes:

• agent and workspace identity metadata;
• connection, route, and operation metadata;
• policy inputs and policy decisions;
• approval metadata and reviewer identity;
• execution status, provider identifiers, latency, and cost metadata;
• Action Record metadata;
• request or response payload content when the configured workflow requires Aethis to inspect or retain it.

Data minimization

Aethis should not retain a raw payload merely because it passed through the product. The default product design is to keep the minimum operational and evidence data needed for governance, support, investigation, and the retention policy chosen by the customer.

Payload content

Some policies require inspection of request fields or payload content before a call can be governed. When payload retention is not required, inspection and retention should remain separate decisions. Where payload content is retained, access to that content is designed to be treated as more sensitive than ordinary metadata.

Credentials

Provider credentials and other secrets are designed to be handled separately from agent-facing route credentials. Customer secrets should not be copied into ordinary logs, analytics events, support tickets, or marketing systems.

Action Records

An Action Record is designed to correlate the request context, policy decision, reviewer information when applicable, execution state, outcome, and evidence metadata for one governed action. It is an operational evidence object, not a claim that Aethis independently verifies every downstream business outcome.

Action Records are designed to be tamper-evident: each record would be written to append-only evidence storage and carry an HMAC integrity hash chained to the previous record, so a changed or missing record breaks the chain. Independent verification without trusting an Aethis-held key is a later goal.

Retention

Evidence retention is designed to be enforced by plan: 30 days for Developer, 90 days for Pro, and 365 days or a custom period for Scale. Automated retention enforcement is not built yet. Customer-specific contractual terms take precedence when applicable.

Where data is processed

The current architecture design places governed-traffic processing at the Cloudflare edge, control-plane and evidence storage in Supabase PostgreSQL, and low-latency policy and cache state in Upstash Redis. Aethis does not make geographic data-residency commitments.

Subprocessors

Production vendors that process customer data are listed in the subprocessor register with their purpose and data category. A service is not added to the register merely because it was evaluated internally.