> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Data handling
> What aiAxonIQ stores about you and your systems, how long it keeps it, how credentials in telemetry are handled at ingest, when data goes to an AI model provider, and how an organization is erased.
This page answers the questions a data-protection or security review asks of an
observability platform: what is stored, for how long, what leaves the platform,
and how it is deleted.
**This page describes mechanisms, not legal commitments.** Contractual terms
for your data are in your agreement with aiAxonIQ. Several behaviours below
depend on the release your deployment runs; where they do, the section says
so, and your account contact can tell you which release you are on.
## What is stored
| Kind | What it is | Where it comes from |
| :------------------ | :------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------- |
| **Telemetry** | Logs, metrics, traces, browser monitoring events, synthetic check results, LLM request records and AgentSight events | Whatever your SDKs, collectors and agents send |
| **Account data** | Your name, email address, a bcrypt hash of your password, and your memberships and roles | Signing up or being invited |
| **Session records** | When each session was created, and the browser user agent and IP address it was created from | Signing in |
| **Configuration** | Dashboards, alert rules, SLOs, synthetic checks, notification channels, license keys | You and your team |
| **Audit records** | Who changed what in your organization, and when | Actions in the product |
**You decide what telemetry contains.** aiAxonIQ stores what it is sent. If your
logs carry customer emails, or your span attributes carry request bodies, those
are stored for the full retention window. The place to remove them is your
exporter, before they leave your network — see
[Collector configuration](/send-data/otel/collector-config).
## Credentials in your telemetry
In current releases, the ingest receiver checks incoming telemetry for
credentials **before** it is queued for storage, and replaces what it finds.
It looks for:
* attributes and headers named like credentials — `authorization`, `cookie`,
`password`, `secret`, `token`, `api_key`, `x-license-key` and similar;
* values shaped like credentials — bearer tokens, HTTP basic credentials,
passwords embedded in URLs, private-key blocks, JWTs, aiAxonIQ license keys,
and several well-known cloud, source-control and chat token formats.
A detected secret is replaced with a redaction marker. What is kept is a keyed
fingerprint — not the value and not a plain hash — so that the same secret can
be recognised again without being recoverable. Telemetry that fails validation
is handled the same way before it is set aside, so a rejected request is not a
place a secret survives.
**This is credential detection, not a guarantee.** It matches names and
formats. A password written in prose ("the password is hunter2"), a custom
token format, or personal data such as names and addresses is **not**
detected. Treat it as a safety net for mistakes, and keep sensitive values
out of telemetry at the source.
### Prompt and response content from AI workloads
In current releases, the **text** of prompts and model responses is dropped at
ingest: the OpenTelemetry GenAI prompt, completion, message and tool-call
content attributes, GenAI message events recorded as logs, and the payload
content of AgentSight capture. Model names, token counts, latency, status and
the other metadata are kept. Deployments on an earlier release may store that
content — see [LLM observability](/guides/llm/overview).
## Retention
Your plan sets one retention window, applied to raw telemetry and to the
rollups derived from it; the default is 30 days. A few record types have their
own fixed windows. Account data and configuration are kept for as long as the
organization exists. The audit log is subject to retention too — see
[Audit log](/guides/audit#export).
The full table is on [Data retention](/concepts/retention).
## Deletion
There is no per-record or per-service delete. Telemetry expires with your
retention window. If something must be removed early — a credential that
reached a log, a mistaken import — contact support.
An Owner can remove a member from the organization. Their sessions end, and
they lose access at once. Their user account is separate from the
organization and is not deleted by removing them. Actions they took remain
in the audit log under their name.
Deleting an organization is requested through aiAxonIQ support. When it is
scheduled, access to the organization stops, and a **30-day grace period**
begins during which the deletion can be cancelled.
When the grace period ends, the organization is erased from the telemetry
store, the log search indices, the AI knowledge base and agent memory, and
the control-plane database. A record that the deletion happened — and what
was removed from each store — is kept as evidence of the erasure.
**Erasure does not reach backups taken before it ran.** Backups are kept on
their own schedule and are not edited after they are taken. Ask your account
contact how long backups are retained for your deployment.
## AI features and model providers
Only some of aiAxonIQ's AI features send anything outside the platform.
| Feature | Sends data to a model provider |
| :------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------- |
| Anomaly detection and forecasting | **No.** Statistical models run inside the platform. |
| The AI assistant, natural-language query, incident summaries, alert and SLO suggestions, prompt analysis | **Yes**, when you use the feature and a model provider is configured |
| The knowledge base — indexing documents and searching them | **Yes**, the document or search text goes to an embedding model, where one is configured |
When you use a feature marked **Yes**, the text it works on is sent to the
configured model provider: the question you asked, and — for the assistant —
the telemetry its tools returned, such as log lines, span names and service
names. Nothing is
sent when you do not use one of these features, and if no provider is
configured those features report that they are unavailable rather than sending
anything elsewhere.
* **Which provider** is used is set by whoever operates the deployment. The AI
service will only send to a host on an allow-list, so a misconfigured address
is refused rather than used. A self-hosted deployment can point at a model it
runs itself. For aiAxonIQ Cloud, ask your account contact which provider your
deployment uses.
* **The AI assistant** passes the text it sends through the same credential
detection described above before it leaves, and never returns the model's
internal reasoning to your browser.
* **Tenant scope is not something a model can change.** See
[Tenant isolation](/security/tenant-isolation#the-ai-assistant-cannot-change-your-tenant).
What each AI feature does, and how to configure it, is on
[AI features](/guides/ai/overview).
## Backups
The control-plane database and the telemetry store are backed up on a schedule
as part of every deployment. Whether backups are copied off the host, and
whether they are encrypted, are **operator settings**: backups can be encrypted
with `age` before they leave the host, and whether they are is a choice made
when the deployment is configured. For aiAxonIQ Cloud,
ask your account contact; for a self-hosted deployment, see the
[Self-hosted security checklist](/security/self-hosted-hardening#backups).
## Next
One window per plan, applied to raw data and its rollups.
How organizations are kept apart.
Authentication, credentials, audit and transport.