Security & data
Know the boundaries before you connect.
Useful security products should explain what they protect, what they retain, and what still depends on your environment.
Account and workspace data
Accounts retain identifiers and password hashes. Workspaces retain membership, roles, invitations, policy configuration, and credential metadata. Platform owners can manage service access; ordinary workspace ownership does not grant platform access.
Agent checks and approvals
Tool names and arguments are processed by the API. Hosted coding decision records omit raw commands and argument objects but retain decision metadata, hashes, and normalized resource identifiers where available. Evidence settings let owners choose metadata-only, customer-retained inputs or operator-enrolled encrypted snapshots for new hosted coding decisions. Encrypted snapshots can retain scoped tool arguments under the configured capture policy. Website approval stores exact proposed arguments encrypted separately for authorized reviewers, regardless of snapshot mode. Other pipelines and imports may retain additional input, output, specifications, and results.
Operational access
Railway runs the services; PostgreSQL and Redis support storage and coordination. Resend delivers account emails. Optional notification providers receive configured notifications. Platform operational logs apply best-effort masking, and deployment administrators can have database access. This is not a hash-only or zero-retention service.
Enforcement and downloads
Protection depends on routing actions through an enabled integration. The hook is not an operating-system sandbox. Native downloads remain preview builds while publisher signing and macOS notarization are pending. A download checksum alone does not establish publisher identity.
Retention and deletion
An expired credential or approval is not evidence that its database record has been deleted. Trace, approval, account, operational-log, and backup retention are separate concerns. There is no published guarantee of automatic deletion or legal hold in the current pilot.
Before sending real data
No service-wide retention period or deletion completion deadline has been committed here for traces, approval payloads, accounts, operational logs or backups. Do not assume a 7-, 30- or 90-day purge. Obtain a written schedule for each category before connecting sensitive systems; use synthetic data until then. Credential expiry is an access limit, not a retention period.
How to request deletion
Stop the sending integration and revoke its connection to prevent new collection. Then contact Privacy below with your workspace identifier, data categories and time range, without credentials or raw tool payloads. The operator must verify authority and confirm the scope, any holds, backup handling and completion separately. Disconnecting, signing out or removing a member does not delete existing evidence. There is no self-service delete-everything button.
Who can read evidence
Workspace roles control application access. Investigators can read forensic timelines, decision metadata, outcome coverage, existing case notes and custody. Notes and titles may contain sensitive user-authored content; this is not a metadata-only guarantee. The role does not grant raw trace/snapshot access, case changes, reconstruction, bundle exports, policy changes or approvals. Forensic API access requires explicit capabilities by default; viewer and legacy auditor roles do not grant them. A temporary API migration exception must name one tenant, expire within seven days and durably audit each use. Platform staff permissions are separate from workspace ownership; infrastructure administrators may still have database access. Application audit controls do not prove that every infrastructure-level read was captured.
Evidence limits
Stored chain verification checks the available snapshot. Signed investigation exports bind selected records to the exporter key; they do not prove complete collection or prevent privileged rewriting before export. An independently trusted checkpoint can provide additional assurance when available. No legal admissibility, compliance certification, or million-user capacity claim is made.
Deployment contact
Operator: Not configured
Support: support@contact.pramagent.com
Security: security@contact.pramagent.com
Privacy: privacy@contact.pramagent.com