Skip to main content
This page answers the questions a data-protection or security review asks of an observability platform: what is stored, for how long, what leaves the platform, and how it is deleted.
This page describes mechanisms, not legal commitments. Contractual terms for your data are in your agreement with aiAxonIQ. Several behaviours below depend on the release your deployment runs; where they do, the section says so, and your account contact can tell you which release you are on.

​
What is stored

You decide what telemetry contains. aiAxonIQ stores what it is sent. If your logs carry customer emails, or your span attributes carry request bodies, those are stored for the full retention window. The place to remove them is your exporter, before they leave your network — see Collector configuration.

​
Credentials in your telemetry

In current releases, the ingest receiver checks incoming telemetry for credentials before it is queued for storage, and replaces what it finds. It looks for:
  • attributes and headers named like credentials — authorization, cookie, password, secret, token, api_key, x-license-key and similar;
  • values shaped like credentials — bearer tokens, HTTP basic credentials, passwords embedded in URLs, private-key blocks, JWTs, aiAxonIQ license keys, and several well-known cloud, source-control and chat token formats.
A detected secret is replaced with a redaction marker. What is kept is a keyed fingerprint — not the value and not a plain hash — so that the same secret can be recognised again without being recoverable. Telemetry that fails validation is handled the same way before it is set aside, so a rejected request is not a place a secret survives.
This is credential detection, not a guarantee. It matches names and formats. A password written in prose (“the password is hunter2”), a custom token format, or personal data such as names and addresses is not detected. Treat it as a safety net for mistakes, and keep sensitive values out of telemetry at the source.

​
Prompt and response content from AI workloads

In current releases, the text of prompts and model responses is dropped at ingest: the OpenTelemetry GenAI prompt, completion, message and tool-call content attributes, GenAI message events recorded as logs, and the payload content of AgentSight capture. Model names, token counts, latency, status and the other metadata are kept. Deployments on an earlier release may store that content — see LLM observability.

​
Retention

Your plan sets one retention window, applied to raw telemetry and to the rollups derived from it; the default is 30 days. A few record types have their own fixed windows. Account data and configuration are kept for as long as the organization exists. The audit log is subject to retention too — see Audit log. The full table is on Data retention.

​
Deletion

There is no per-record or per-service delete. Telemetry expires with your retention window. If something must be removed early — a credential that reached a log, a mistaken import — contact support.
An Owner can remove a member from the organization. Their sessions end, and they lose access at once. Their user account is separate from the organization and is not deleted by removing them. Actions they took remain in the audit log under their name.
Deleting an organization is requested through aiAxonIQ support. When it is scheduled, access to the organization stops, and a 30-day grace period begins during which the deletion can be cancelled.When the grace period ends, the organization is erased from the telemetry store, the log search indices, the AI knowledge base and agent memory, and the control-plane database. A record that the deletion happened — and what was removed from each store — is kept as evidence of the erasure.
Erasure does not reach backups taken before it ran. Backups are kept on their own schedule and are not edited after they are taken. Ask your account contact how long backups are retained for your deployment.

​
AI features and model providers

Only some of aiAxonIQ’s AI features send anything outside the platform. When you use a feature marked Yes, the text it works on is sent to the configured model provider: the question you asked, and — for the assistant — the telemetry its tools returned, such as log lines, span names and service names. Nothing is sent when you do not use one of these features, and if no provider is configured those features report that they are unavailable rather than sending anything elsewhere.
  • Which provider is used is set by whoever operates the deployment. The AI service will only send to a host on an allow-list, so a misconfigured address is refused rather than used. A self-hosted deployment can point at a model it runs itself. For aiAxonIQ Cloud, ask your account contact which provider your deployment uses.
  • The AI assistant passes the text it sends through the same credential detection described above before it leaves, and never returns the model’s internal reasoning to your browser.
  • Tenant scope is not something a model can change. See Tenant isolation.
What each AI feature does, and how to configure it, is on AI features.

​
Backups

The control-plane database and the telemetry store are backed up on a schedule as part of every deployment. Whether backups are copied off the host, and whether they are encrypted, are operator settings: backups can be encrypted with age before they leave the host, and whether they are is a choice made when the deployment is configured. For aiAxonIQ Cloud, ask your account contact; for a self-hosted deployment, see the Self-hosted security checklist.

​
Next

Data retention

One window per plan, applied to raw data and its rollups.

Tenant isolation

How organizations are kept apart.

Security overview

Authentication, credentials, audit and transport.