What RIG stores, what we never see, and how long we keep it. No marketing fuzz.
Taken directly from our security disclosure. If a claim here drifts from runtime behavior, report it.
| Question | Answer |
|---|---|
| what RIG stores | ProofPacket metadata: hashes (input, output, chain), run status, timestamps, agent/version identity, token counts, billing records. Hashes, not content. |
| what RIG never stores | On Enterprise on-prem: raw prompts and completions never leave your infrastructure — the runtime runs in your VPC and phones home hashes only. On cloud tiers, prompt content is processed in memory and discarded at seal; run logging of content is opt-in and off by default. |
| retention | Packets: account lifetime (they are the ledger). Optional run logs: 30 days on Pro, configurable on Enterprise. Audit logs: 7 years. Deleted-account data purged within 30 days. |
| encryption | TLS 1.3 in transit, everywhere, no exceptions. AES-256 at rest. Per-tenant key isolation on Enterprise. |
| region pinning | Workspace-pinned to us-east or eu-west. Packets, logs, and backups never leave the pinned region. |
Account owners can export all ProofPacket metadata from the dashboard or via the /export API. Erasure requests apply to optional run logs and account metadata; sealed ledger hashes required for billing and compliance are retained as hashed, pseudonymized records.
For data-subject requests, contact legal@rig.fyi. We answer within 30 days and will tell you if a request conflicts with a legal hold.
Current subprocessors for cloud infrastructure, analytics, and support. Updated when the list changes.
| Function | Provider | Region |
|---|---|---|
| cloud compute / storage | Cloudflare + Vercel | us-east / eu-west |
| model inference | OpenAI, Anthropic | region-pinned via proxy |
| billing | Stripe | US |
| support / ticketing | Linear | US |
Privacy is a runtime property, not a policy page. If something is unclear, we want to know.