Privacy

What we store

• Work email and workspace membership
• Hashes of API keys, session tokens, invite tokens, and client IPs
• Receipt metadata (id, source, observed time, evidence states, completeness tier)
• Content-addressed blob digests and entitled artifact bytes
• Stripe customer, subscription, and invoice identifiers

We do not store card PAN or CVC. IP addresses are hashed or truncated, never logged raw.

What we do not store

Anonymous verify bodies are not persisted. Locator credentials and secret query parameters are rejected and not echoed.

Retention

• Public-listed receipts: digest-only after 90 days unless still under a paid window
• Pilot and API private blobs: 365 days, then digest-only
• Receipt IDs and verification summaries remain after blob expiry

Deletion

Workspace deletion starts a 30-day freeze. Login and entitled export still work. After the freeze, keys, members, shares, and usage are removed. Canonical receipt IDs and digests are retained. Payment failure never deletes receipts.

Person deletion removes that user's memberships and sessions. A last admin must transfer admin or delete the workspace first.

Operator

Controller: AWEN operator (demo).

Residency

Processing runs in the operator-configured deployment region until a public region string is published.

Abuse: Report abuse. Questions: support@example.invalid

Evidence state only. Not a certification, guarantee, background check, or quality score.