Privacy
This notice covers the TerraFlow hosted preview: this site, your workspace and the requests you send to it. The preview is operated by AutoNous Systems. It is built to hold as little about you as it can.
What is kept about you
| What | Where | For how long |
|---|---|---|
| The organisation name your invite was created for, the workspace's dates and state, and its total spend | The operator's registry on the server | For as long as the workspace exists; after deletion, a single row with the organisation name, the dates and the total spend is kept |
The organisation name again, as your workspace's tenant name; the console's status call (/api/preview/status) returns it to signed-in users |
Your workspace's database | Until the workspace is deleted |
| Your workspace's spend counters: lifetime spend, allowance, provider calls per minute, and its share of this month's preview-wide spend | The spend guard (Redis) on the server | Until the workspace is deleted; its share of the month's spend stays counted until that month's counter expires |
| The username you choose (never an e-mail address) and a scrypt hash of your password; the same for colleagues you invite | Your workspace's database | Until the workspace is deleted |
| Request metadata and evidence: times, workload, the model chosen, outcome, reason code, cost, token counts, what kind of sensitive data was detected (counts, never the values), your correlation and trace ids | Your workspace's database | Until the workspace is deleted |
| Semantic-cache vectors: numbers computed from your prompts so that a near-identical question can be answered from cache | Your workspace's database | Until the workspace is deleted |
| Cached answers | Your workspace's cache, in memory only, never on disk | No longer than the workload's retention setting allows, and lost whenever the workspace restarts |
Your client IP address and port, with the time, protocol, method, host, path (any query string is replaced by ?REDACTED), TLS details, sizes, status and duration of each request; never a header, so never your API key or cookie |
The edge's access log | 14 days |
| Backups of your workspace: a nightly dump of its database, and an archive of its signing keys | The server's disk; the key archives in a directory that is not mounted into the database server | 7 days |
TerraFlow keeps no prompt or answer text in your workspace's database, logs or backups. There is no sign-up form, no marketing list, no analytics, no tracking and no cookies on this site. The console sets one session cookie when you sign in, and keeps small conveniences in your own browser's storage: your theme, your tour progress, and whether the console last found itself on a hosted preview (so the sign-in page can say so).
Your e-mail address is known only to the AutoNous Systems contact who sent your invite, in their own e-mail. It is never entered into the preview.
What leaves the server
Your prompts and the answers go to the model providers that serve them, under AutoNous Systems' accounts: Anthropic, Microsoft (Azure OpenAI) and Google (Gemini API). Each provider keeps API traffic for its own period. The models table lists, per model, the retention and training terms recorded in the preview's catalogue as read from each provider's published terms, with the date they were read; Google's no-training term holds only for the paid tier of the Gemini API (that the preview's key is on the paid tier is to be confirmed by the operator before the preview opens). This is why the preview is for synthetic or public data only. Nothing else leaves the server: no telemetry is exported.
How long a workspace lasts
A workspace lasts 30 days unless AutoNous Systems extends it. At the end it is stopped: no one can sign in to it or call it. An invite that is never used expires after 7 days, and its workspace is then deleted. AutoNous Systems may reset or delete any workspace, and the workspace data with it.
Having your data deleted
Write to the AutoNous Systems contact who sent you here and ask for your workspace to be deleted. The operator deletes its
database, cache, signing keys, its spend-guard user, its spend-guard counters under sg:<workspace>: (all but the
month share below) and the edge's routing to it.
What remains afterwards is the registry row described above, the workspace's share of the current month's
preview-wide spend in the spend guard (a number, so the monthly ceiling still holds) until that month's counter
expires, the edge's access log until its 14 days pass, and backups until their 7 days pass. Anything a provider kept is
held under that provider's terms for its published period.
Questions
Write to your AutoNous Systems contact.