Data retention

How long Telmoni keeps each kind of data — telemetry, the organization's records, accounts and sessions, the console agent's data — what ends each window, and what the hosted service keeps in backups and logs.

Telmoni keeps each kind of data for a window of its own. The windows are the platform's: the same on a self-hosted deployment and on the hosted service, and none is set per project yet. Deleting a project, an organization or an account ends every window early for what they held, as Data deletion describes.

Telemetry

Telemetry is kept only while its project is active.

Data	Kept	Then
Spans: every run, step, model call and tool call, as metadata	360 days after a span arrives	`telmoni rotate` drops each day of spans once every span in it is older
Hourly totals: spans, units, tokens and durations by project, agent, kind, model, provider, tool, status, environment and release, which name no user and no tag	13 months	`rotate` drops each month of totals once it is older
A deleted project's spans and totals	Until the project is deleted	Marked deleted the moment the project goes, and gone from every read within moments, as the store applies the mark; `rotate` rewrites them off the disk that night
The claim on an export's bytes, which answers a retry with the first answer rather than writing twice	1 hour	Expires
A project's telemetry settings: its content mode, whether end-user ids are hashed, and the key they are hashed under	While the project exists	Purged with the project
A project's saved views of its traces: each one's name, filters, sort, window and columns	Until an Owner or Admin deletes it, or the project goes	Purged with the project
A project's saved layouts of its sessions and traces: each one's name, options and columns, and the layout the project opens in	Until an Owner or Admin deletes it, or the project goes	Purged with the project

Content — prompts, completions, system instructions, tool inputs and outputs, retrieved documents, error messages and every attribute that names a person — is kept for no time at all: it is dropped at the door in the one content mode offered today, as the ingest page lists. An end user's id is stored only as a keyed hash (Users).

The organization's records

Data	Kept	Then
Organizations, projects, members and roles	While they exist	Deleted with the organization, or the project
Invitations	Until accepted, declined or withdrawn, or 7 days; an unaccepted one's record 30 days past expiry or withdrawal, an accepted one's until its acceptor's account is erased or its project or organization is deleted	The retention sweep deletes an unaccepted one's record
API keys	While live; a revoked or expired key's record 7 days	The retention sweep deletes the record
Connectors: Slack grants, webhook endpoints and their signing secrets	While connected; a Slack bot token until Slack has taken its app back, a day at most	Erased when disconnected, or with the project or the organization, the Slack app uninstalled from a workspace no other connection uses
Activity feed notices	90 days	The notifications sweep deletes them
Connector deliveries: what was sent where, and the answer	30 days	The same sweep
The audit log	Without a time limit, through the organization's deletion	Never deleted: its monthly partitions are kept, and only an export's file is a copy
Audit log exports	7 days after the file is built	The audit-export sweep deletes the file

Accounts and sessions

Data	Kept	Then
Your account: the name and address your identity provider or password account gave	While the account exists	Erased when you delete the account
Sessions	Until signed out or revoked; one unused for 30 days can no longer be resumed, but its row stays until you end it or delete your account; a revoked session's row 90 days	The retention sweep deletes a revoked session's row
Sign-in codes, device authorizations and the tokens nobody can use any more	Usable for minutes; the daily retention sweep deletes them once expired or spent, a spent refresh token after a day	The retention sweep deletes them
Confirmation codes, for a deletion or an email change	15 minutes	Expire; five wrong guesses burn one

The console agent

Data	Kept	Then
Your conversations with the agent, visible to you alone	90 days after a conversation was last used	The agent's retention sweep deletes them
Its search index: copies of the audit log, feed notices, connector deliveries and your own answered questions	730, 90, 30 and 90 days: each copy no longer than its source	The same sweep
The documentation a deployment indexes	Until it is updated or removed from the corpus	Re-indexed

What the agent sends its model provider is on the account's Privacy page.

On the hosted service

Backups. The database is backed up daily, with seven days of point-in-time recovery, and thirty daily backups are kept. Telemetry's store is backed up nightly, and none of its backups is kept past thirty days. Deleted data leaves the backups as they expire, within thirty days.
Operational logs are kept thirty days. They name ids, never addresses.
The console agent's model provider keeps each request 55 days to detect abuse, as the Subprocessors page states.

The hosted service's commitments are in its Privacy Policy.

On a self-hosted deployment

The windows above hold as long as telmoni rotate runs daily and the server's sweeps run, as the production guide describes: spans and totals go when rotate drops them, and the rest when the sweeps inside telmoni serve pass. Your backups are yours, and so is their window.

TelemetryCopy Anchor Link

The organization's recordsCopy Anchor Link

Accounts and sessionsCopy Anchor Link

The console agentCopy Anchor Link

On the hosted serviceCopy Anchor Link