Data, residency, retention

The short version, then the details.

We don't train on your data. Your scenes, conversations, and tool inputs/outputs stay in your workspace, in one database we operate. Region choice, VPC, and on-prem are enterprise conversations — not self-serve toggles.

What "your data" means here

In a typical Daslab workspace, the data we hold includes:

  • Scenes and cells — definitions, configurations, layouts.
  • Conversations and tool traces — every prompt, every tool call, every response. The audit trail.
  • Tool outputs — when the agent fetches data from S/4 or Gmail or Postgres, that data is included in the trace.
  • Connections — encrypted credentials for the systems you've linked.

This is your operational data. It belongs to you. We hold it because we have to, to run the runtime — but we don't use it for any purpose other than running your scenes.

What we never do with your data

  • Train foundation models on it. We don't fine-tune on customer data, and we configure our LLM provider integrations to opt out of training on inputs/outputs (provider-supported flags, where available).
  • Sell or share it with third parties. There is no analytics partner, no ad network, no data broker.
  • Use one customer's data to improve another customer's product experience. Workspace boundaries are hard, not soft.
  • Read it for any reason other than operating the runtime, debugging at your request, or responding to legal requirements.

One region today

Daslab runs in one region on our cloud provider; there is no per-workspace region picker.

For enterprise customers who need it: VPC deployment (your AWS / Azure / GCP account, your VPC, our control plane managing it) and on-prem (your data center, our software running in it). Talk to us — these aren't self-serve.

Nothing is deleted today

Records are retained indefinitely — append-only, with no deletion path.

Encryption

In transit: TLS for all client connections and outbound calls.

At rest: the database is access-controlled and workspace-scoped; stored credentials are not field-level encrypted. Blueprint exports never carry plaintext credentials — secret fields seal into an age-encrypted vault, leaving only references.

Subprocessors

We use a small number of subprocessors:

  • A cloud provider (Render today, eventually multi-cloud).
  • LLM providers — only those you explicitly connect via BYOK. We don't have a "default Daslab LLM" that sees your data.
  • A transactional email provider for account emails.
  • Sentry-equivalent for error reporting (PII scrubbed).

Full list available on request, with DPAs in place where required.

What's next

Updated 2026-04-30