Privacy

What orbslate keeps about you, where, and for how long. This page and the code are held to the same table by a test.

What never reaches us. Your systems' credentials (kubeconfigs, database passwords, connection strings) and the results of the tools your AI client calls stay on your machines. The agent sends the service its licence check and the connections it serves (their names, kinds and versions, never their credentials), and asks it for your policy; your results go from the agent to your AI client and nowhere else.

Who else is involved. The service runs on Cloudflare, which carries its requests and stores its database, and whose Turnstile check may look at your browser when you sign up. Nothing about you is sold or shared for advertising, and there are no trackers on these pages.

In your browser. One cookie holds your sign-in; the console remembers your theme in your browser's own storage.

What is kept, and for how long

The service: Your account: your address, a salted hash of your password (never the password), when you confirmed the address and last signed in, and wrong-password counts for the lockout; until you delete your account
The service: Your sign-ins: a hash of each browser's session token and when it was last used; 30 days from its last use, or until you sign out
The service: The links we mail or show you (to confirm an address, reset a password, join a workspace or sign up) and the codes that pair an agent: a hash of each, whom it is for and when it was used; for a pairing, the machine's name and platform; as a record after use; each works only until it is used or expires (2 hours for a reset, 3 days to confirm, 7 days for an invitation, 10 minutes for a pairing code)
The service: Your workspaces: their names, members and roles, the environment rules and each published policy, a hash of each API token with its name, and each workspace's plan and, once it pays, the ids of its Stripe customer and subscription, the subscription's status and its seats. The card and the invoices are Stripe's: we never see a card number; until the workspace is deleted, which cancels its subscription first
The service: The ids of the payment events Stripe sends us, so none is applied twice: the id, its type and when it came, never what it said; 30 days
The service: Your agents and connections: each machine's name, version, platform, when it last checked in and which model its runs use (never the model's key); each connection's kind, name, environment, tier and what its agent reported (version, namespaces), never its credential; until the workspace is deleted
The service: The apps you let into a workspace through sign-in (claude.ai, Claude Desktop): each app's name as it gave it, where its access goes, what it may do, and when it was let in and last used; the access itself is kept only as hashes and encrypted; until you disconnect it or the workspace is deleted; its access ends when you disconnect it
The service: A database's map, where an agent reflected one: its tables' and columns' names and types, its keys, indexes and comments, and the database's own row estimates, never a row and never a credential; until the connection is removed or the workspace is deleted
The service: What the map means: the tags and join hints people applied to its columns, the proposals waiting for a person (each tag and hint with its reason), a history of what each apply changed and who applied it, and the masking an Owner set for a tag of the vocabulary, with who set it and when; until the workspace is deleted; a column's tags and hints go with its connection
The service: A write that waits for a second person's approval: the tool, where it acts, the reason, who asked and who decided, and what it answered once it ran; its arguments as they were asked only while it waits, and as the audit keeps them (secrets masked) after; until the workspace is deleted; the arguments as asked go when it runs, is declined, or expires after 30 minutes
The service: The workspace's audit: a row per tool call through its gateway (and per call its agents upload, where the plan keeps the audit in the service): when, who asked (the member and the token, or the agent), the tool, the connection, the tier, the decision and the outcome, how long, how many bytes, whether personal values were shown, the arguments with secrets masked, never a result; 7 days on Solo and 90 on Team; on Enterprise as its contract says, a year until it says otherwise. An hourly sweep deletes what is older, and everything goes with the workspace
The service: The address a sign-up or a password reset came from, counted to refuse a flood; and a count of the mail sent each day; an address's count is dropped once it is an hour old, the next time that address is counted; the daily count holds no address
The service: The service's own settings, such as whether sign-ups are open; until changed
The service: A copy of the service's database, taken daily, to recover from a disaster; 30 days
The host: Request lines and errors in the host's logs (Cloudflare), never a request's body; the host's rolling window
The service: Playbooks: each one's name, its text (the schedule, the connections it may use, its budget, whether it may act, and what it should do), who made it and who saved it last; until it is deleted, or the workspace is
The service: Run records: when each run of a playbook began and ended, on which agent and with which model (never its key), how many tool calls and tokens, the model's final report with secrets masked on the agent, and each call's audit metadata (the tool, the connection, the tier, the decision and the outcome, how long, how many bytes, the arguments masked), never a result; 90 days; an hourly sweep deletes what is older, and everything goes with the workspace
Your machine: The agent's own copy of each run's record, and the playbooks it was last given; 30 days for the records; the playbooks until the next pull
Your machine: The model key Runs use, in this machine's keyring; the prompts and the tool results of a run go only to the model provider you chose, from this machine; until `model remove`
Your machine: The agent's audit: a row per tool call (when, the tool, the connection, the tier, the decision and the outcome, how long, how many bytes, the arguments with secrets masked), never a result; 30 days
Your machine: The agent's log of its own events, with no secrets and no results; 7 days
Your machine: The map of each database the agent reflected, as it last read it: the same names, types, keys, comments and estimates, never a row; until the connection is removed
Your machine: The tags and join hints applied on this machine, the proposals made here, and a history of what each apply changed; until you delete the agent's folder

Your choices

Settings in the console deletes a workspace, or your account with every workspace where you are the only member. What is deleted leaves the daily copies as they age out. For anything else, write to support@orbslate.com.