Data protection — Vaethra

01Classification

Four classes, and which of your data falls into each

Class	Contents	Handling
Public record	Events, entities, observations and graph edges derived from 55 public feeds — the great majority of what we hold	Served under the licence of its source. Every record carries its publisher, its licence and both timestamps: when the source published it and when we first saw it.
Licence-restricted record	Records from sources whose terms do not permit republishing them individually	Ingested and used for analysis; never served as an individual record and never included in an extract
Customer business record	API key digests, request logs, contact details, contract and billing records	The only class in which a customer is identifiable. Under forced row-level security on the customer plane and reachable only through a role that cannot bypass it. Not shared with anyone.
Operational data	Source run records, job health, cached responses, integrity check findings	Internal, summarised publicly on status

The customer-content class exists in the workspace — a customer's own facilities, routes and assets — and is the most protected class here: forced row-level security, a connection that cannot bypass it, and the negative cases tested rather than asserted. No customer content is held in it today.

02The licence filter

Three classes of source, enforced in code and in the database

Class	Sources	Served as records	In a bulk extract
Open	46	Yes	Yes
Non-commercial	7	Yes, with the licence attached to every record	No
Internal	2	No — neither events nor observations	No

Figures measured 11 October 2026 and readable from /api/v1/licences, which reports the same numbers from the running system alongside the count of restricted records held and the count publicly visible, which is zero.

How it is enforced:

The class is a required field on every source definition, so a new source cannot be added until its licence has been read and recorded.
The filter is implemented in the shared query builder rather than at each endpoint, so a new endpoint cannot omit it.
The database enforces it independently, with its own flag and its own condition, so an application error does not defeat it.
An automated check probes for leakage and alerts if it finds any, and the code and the database are compared against each other on every operations report.

03Encryption

Algorithms by state

State	Protection
In transit, public	TLS 1.2 minimum, TLS 1.3 preferred. HSTS for one year including subdomains. HTTP is redirected and never served.
In transit, internal	TLS through Cloudflare Hyperdrive. The database refuses plaintext connections and any source outside Cloudflare's address ranges.
At rest, database	AES-256, including backups and replicas
At rest, object storage	AES-256
At rest, secrets	Encrypted in the platform secret store, not readable back
API keys	SHA-256 digest. The key is never stored, so a copy of the database yields no usable credential.
Endpoint devices	Full-disk encryption, screen lock

Key management is performed by the platforms. We do not operate a key hierarchy of our own. Customer-managed keys are not offered.

04Retention

How long each class is held, and why

Data	Retention	Reason
The public record — events, entities, observations, graph	Indefinite	It is the product. A disruption archive that forgets cannot support the correlation and backtesting the system exists for.
Record revision history	Indefinite	Provenance. Any figure must be traceable to the fetch that produced it, including a figure that later changed.
API request logs	12 months	Billing, abuse handling, incident reconstruction
Source run records	Rolling window	Operational health
Cached responses	Seconds to hours	Performance. Not a system of record.
Database backups	7 days standard, 28 days on enterprise	Recovery. See business continuity.
Webhook alert rules	Until deleted, or 120 days after the last delivery attempt or save	So that an unowned rule does not continue firing
Contract and billing records	7 years	Statutory tax and accounting retention

05Deletion and disposal

What can be deleted and how quickly

API key records: revoked immediately on request; the record is deleted at the end of the contract, subject to statutory retention on the billing record.
Webhook alert rules: deleted immediately on request, or by you at any time from the Terminal.
Contact details: deleted on request, subject to the same statutory retention.
Request logs: expire on the 12-month schedule and can be purged earlier on request.
Deletion completes within 30 days of a verified request, across primary storage and caches. Data in backups is removed as those backups age out of the retention window; backups remain encrypted and access-controlled throughout.

The public record is outside the scope of a deletion request: it is not customer data and it comes from a published source. Where a source corrects or withdraws a record, our copy carries the correction with its revision history intact.

Media disposal is performed by the infrastructure providers, whose attestations cover secure disposal. See subprocessors.

06Residency and transfers

Where data is processed

Data	Location
The analytical database and its backups	AWS `us-east-2`, United States (standard); EU region offered on enterprise agreements, provisioned at contract
Cached responses, extracts, coordination state	Cloudflare's global network, cached at the location nearest the reader
Model inference	Cloudflare's network; text does not leave it
Source control	United States. Never holds production data.

Vaethra Technologies LLC is established in the United States, so for a customer in the EEA or the UK we are the data importer: transfers are covered by the 2021 Standard Contractual Clauses, incorporated in the DPA together with the supplementary measures set out there. Both infrastructure providers maintain their own transfer mechanisms.

EU data residency is offered on enterprise agreements. The database platform supports EU regions; where residency is a requirement, it is agreed at contract, a project in an EU region is provisioned within one business day of the order, and the record is migrated to it before the go-live date the order states. It is a provisioning step, not a setting, and the agreement says so.

07Ownership and export

Who owns what, and how you obtain a copy

You own your data. Anything you provide — contact details, alert rules, and in the enterprise workspace your own facilities and routes — remains yours. We claim no licence over it beyond operating the service, and we do not use it to train anything.
The public record is licensed rather than owned. It comes from public sources under their own terms, and what you may do with it is set by those terms, which travel with every record in a license field. We cannot grant rights the upstream publisher did not grant us.
Export is a standard feature. The API returns JSON and CSV, bulk extracts are pre-built files, and the OpenAPI document is public. There is no export fee and no exit fee.
On termination, a complete export of anything you supplied is provided within 30 days on request, in a machine-readable format.
We do not sell, share, rent or broker data. There is no advertising, no analytics broker and no data broker anywhere in this business.