Data handling and privacy commitments
What data AskVault stores
Three categories:
- Customer-facing content. Knowledge sources (documents, URLs, snippets) you upload. Used for the bot's answers.
- Conversation data. Messages, metadata, citations, agent actions, audit logs.
- Account data. Your user account info, billing details, team membership.
What we don't store:
- Credit card numbers. Handled by payment processors only. Not in AskVault scope.
- Passwords. Stored as one-way salted hashes, never the plaintext.
Encryption
Two layers:
At rest. The managed database that holds your documents, indexed text and conversations is encrypted with AES-256 by its provider. Channel secrets such as bot tokens, webhook secrets and OAuth tokens are also encrypted inside the application before they are saved.
In transit. The API (api.askvault.co) sends HSTS with preload and a 365-day max-age. All AskVault sites use HTTPS with TLS 1.2 or higher.
Never used for training
A clear commitment:
- Your content is not used to train shared AI models.
- Your conversations are not used to train shared AI models.
- Your customer data is not used to train shared AI models.
This applies to AskVault itself. Whether an LLM provider may use API traffic for its own training is set by that provider's terms.
If we ever offered an opt-in "improve the AI" feature, it would be explicit, off by default, and revocable. Today, no such feature exists.
Workspace isolation
Every workspace is kept apart by the queries themselves:
- Indexed content. Every search over your documents and pages is filtered to your workspace ID.
- Conversations and contacts. Reads are filtered the same way, and an API key only ever reaches the workspace it belongs to.
- Identifiers. Workspaces, documents and conversations use random UUIDs.
This is the model on every plan, including Enterprise. AskVault runs on shared, multi-tenant infrastructure; there is no dedicated single-tenant tier today.
Data retention
Conversation logs are kept for a set number of days that depends on your plan, then purged automatically.
| Plan | Conversation history kept |
|---|---|
| Free | 7 days |
| Starter | 30 days |
| Growth | 90 days |
| Business | 365 days |
| Enterprise | 365 days |
Your indexed content stays until you delete it or the workspace is removed. A Free workspace with no conversations for 30 days can be removed, after a pause notice at 21 days.
Data deletion
How deletion works at each level:
A conversation. There is no control to delete a single conversation. Conversations older than your plan's retention window are deleted automatically.
One person. Deleting one person's contact record and conversations is rolling out and not yet switched on. Until it is, email [email protected] with a GDPR Article 17 request you cannot handle by deleting the workspace. See GDPR.
A workspace. The owner can delete it under Settings > Danger Zone, which removes its documents, indexed content and conversations.
Data portability (export)
Under GDPR Article 20 (and equivalent):
- One person's data (rolling out, not yet switched on). Workspace admins will be able to export everything AskVault holds about one person (contacts, conversations and leads) as JSON through a data-subject request.
- All conversations. Export every conversation in a workspace as CSV, on Growth and up.
- One conversation. Export a single conversation's messages as CSV. See conversation export.
- Leads. Export captured leads as CSV, on Growth and up.
Sub-processors
We use sub-processors to deliver the service:
- Hosting and infrastructure. Fly.io (application), Neon (database), Cloudflare (website and CDN).
- AI model providers. Leading model providers that write answers from your content; their terms govern retention.
- Email delivery. Transactional email provider for verification, alerts, notifications.
- Payment processing. Our merchant of record, Dodo Payments, handles checkout, tax and invoices.
- Product analytics. Privacy-focused usage analytics for our own website and dashboard.
Full list under sub-processors with the categories of data each handles.
Customer-data processing roles
Per GDPR roles:
- AskVault is the data processor. We handle data on your instructions.
- You are the data controller for the customers who interact with your bot.
- End customers are the data subjects.
A standard DPA covers this relationship. A DPA is available on request — email [email protected]. See the DPA page.
Regional data residency
Where data is stored:
- All accounts. A single primary region, with backups replicated within that same region.
AskVault does not currently offer EU-specific data residency or customer-selectable regions. For cross-border transfer coverage (including EU-to-primary-region transfers), see the DPA.
Audit and access control
Who can access your data:
On your side.
- Workspace owner and admins: full access.
- Members: work with knowledge and conversations.
- Support and viewers: lower-access roles. Viewers are read-only.
- API keys: each key works for one workspace, with no finer permissions.
On our side.
- No engineer accesses customer data routinely.
- Workspace audit log. Actions in your workspace are recorded in its audit log, and entries are kept for 365 days on every plan.
Security posture summary
- SOC 2 Type II. Held by our database provider. AskVault does not hold its own SOC 2 report; see the SOC 2 page.
- HIPAA. AskVault does not currently sign Business Associate Agreements (BAAs) on any plan and is not HIPAA compliant. Don't process protected health information (PHI) on any plan.
- GDPR. AskVault acts as your processor and supports data-subject access and deletion requests. See GDPR.
- Encryption. TLS 1.2 or higher in transit; AES-256 at rest at the database provider.
See security overview for the full posture.
Customer-led data deletion
For GDPR or CCPA requests, delete the workspace or your account from Settings, or let the plan's retention window remove old conversations. Deleting one person's data, by dashboard or API, is rolling out and not yet switched on; see GDPR for what it will cover.
Deleted data can stay in our database provider's encrypted backups until those backups expire. Email [email protected] for the current backup window.
For a request you cannot handle yourself, contact support. GDPR gives you one month to answer the person, so write to us early.
Breach response
If a security incident occurs:
- Detection. We work to catch anomalies as early as possible; this isn't backed by a monitoring SLA today.
- Containment. Affected systems isolated as quickly as the incident allows.
- Investigation. Root cause analysis follows containment.
- Notification. Affected customers notified without undue delay once the incident is confirmed.
- Remediation. Fix deployed, monitoring confirms.
- Postmortem. Findings shared internally and with affected customers.
See incident response policy for the full procedure.
Logging and observability
What we log:
- API access events. Method, path, status, duration, client IP and workspace ID.
- Authentication events. Login, password change.
- Data-modifying actions. Create, update, delete on customer data.
- Bot conversations. Full transcript for the workspace's retention period.
What we don't log:
- Plaintext passwords.
- API key values.
- Card numbers, CVV.
- HMAC secrets, OAuth tokens.
Secret tokens in URLs and credentials in error reports are redacted before logging. Wider redaction of personal data in logs is built but not yet switched on.
Planned commitments (on the roadmap)
Documented for accuracy. We list these to be transparent about what we'll add:
- Customer-managed encryption keys (CMK). Today, AskVault manages encryption keys. CMK / BYOK planned for Enterprise.
- Confidential-compute mode. Today, standard encryption. Confidential VMs for Enterprise workloads planned.
- Per-conversation auto-deletion timer. Today, retention is workspace-scoped. Per-conversation timers planned.
- Selective LLM provider opt-out. Today, provider routing is workspace-scoped. Per-conversation provider choice planned.
FAQ
Is my data used to train AskVault's AI?
No. Your content and conversations stay yours.
Where is my data stored?
All accounts: a single primary region, with backups replicated within that region. Region selection and EU-specific data residency are not currently available.
How long do you keep data after I delete it?
Deleting a workspace or your account removes the data from the live database. Deleted data can stay in our database provider's encrypted backups until those backups expire. Email [email protected] for the current backup window.
Can I export everything?
You can export one conversation as CSV on any plan, and all conversations or all leads as CSV on Growth and above. Exporting one person's data as JSON is rolling out.
What happens to my data if AskVault shuts down?
AskVault has not published a wind-down commitment. You can export a single conversation on any plan, and all conversations or leads on Growth and above.