Data residency and retention

You decide where PromptGlass data lives and how long it is kept. SaaS tenants are pinned to one region (US, EU or Canada). Self-hosted and air-gapped deployments keep everything in your own infrastructure. Retention is set separately for content, metadata and audit records, and can vary by data class and policy rule.

Residency

Deployment	Where data lives
SaaS: US	US region; support access from approved personnel under contract
SaaS: EU	EU region; processing and storage in the EU
SaaS: Canada	Canadian region
Self-hosted (Kubernetes)	Your clusters, databases and buckets
Air-gapped	Your isolated environment; no vendor connectivity

Hybrid gateways process prompt content locally and send only what the storage mode allows to the SaaS region.

Retention defaults

Data	Default	Configurable range
Prompt/response content (full/redacted)	90 days	0 days – 7 years
Event metadata (who/what/when, tokens, cost)	13 months	30 days – 7 years
Detections	13 months	30 days – 7 years
Admin audit log	7 years	1 – 10 years
Aggregates (k-anonymous)	Indefinite	—

Override retention per rule:

rules:
  - name: keep-secret-leaks-for-investigation
    match: { data_class: [secret.*] }
    action: block
    storage: redacted
    retention: 1y

Encryption

• In transit: TLS 1.3 between all components. Agents and gateways use mTLS.
• At rest: envelope encryption of content with AES-256-GCM data keys wrapped by a KMS/HSM key. In self-hosted deployments the key is yours (AWS KMS, Azure Key Vault, GCP KMS, HashiCorp Vault or PKCS#11). In SaaS, BYOK is available.
• Crypto-shredding: deleting the tenant key makes all stored content unreadable at once.

Legal hold

Investigators can put events on legal hold. Held events are exempt from retention purges until the hold is released, and every hold is audited.

Deletion and export

promptglass privacy erase --user jane.doe@example.com --scope content,metadata --dry-run
promptglass export events --since 2026-01-01 --dest s3://acme-archive/promptglass/ --format parquet

Erasure requests remove content and pseudonymize metadata. Aggregates that can no longer identify the person are kept.