Data privacy
Data falls into four categories: what never leaves your organization, what leaves only in encrypted form, what leaves in plain form but is stored encrypted, and what leaves and is stored in plain form. For each category, the tables below say who can read the data and how long the cloud keeps it.
What never leaves your organization
Secrets read with sys.secret from the agent server's environment or from files never leave the server. Agents run on the agent server, and every call to your APIs, databases, LLM providers and MCP servers leaves from there. The data those calls return stays on the server, unless an agent writes the data into its output or into a conversation variable. The log command writes to the server's own log, and nothing in that log is sent to the cloud.
What leaves only in encrypted form
The agent server encrypts these before sending them, and the cloud stores the ciphertext without ever decrypting it. See Encryption for who holds the key.
| Data | Who can read it | Kept for |
|---|---|---|
| Conversation state variables, prompt history, output, where an agent paused | Only the user whose conversation it is; the account's agent servers decrypt it to answer that user's next request | 7 days after the last use on the Free plan, 90 days on Paid; pinned conversations indefinitely |
| Hosted secrets available only with end-to-end encryption | The agent server, at runtime | Life of the account |
| Prompt profiles the system and user prompt text; a prompt written in an agent is stored in plain form with the agent | Developers and above, through the GUI; the account's agent servers decrypt them at runtime | Life of the profile |
What leaves in plain form but is stored encrypted
| Data | What the cloud does with the plain text | Who can read it | Kept for |
|---|---|---|---|
| The user's query | Finds the matching agent. The shortened query is then stored encrypted as the conversation title, and the full query is stored encrypted on the execution record. | Only the user who typed it | Title: with the conversation. Execution record: 7 days on the Free plan, 90 days on Paid |
| Agent descriptions | Indexes the agent for search. The plain text is held in memory for that and never stored. | Developers and above | Life of the agent |
| Long-term memories written by agents with the memory command | Embeds the memory text for semantic search. The label is stored in plain form. | Agents run by the user the memory belongs to | Until the agent that stored the memory is deleted |
What leaves and is stored in plain form
Everything else. The cloud works with these directly: checks definitions, serves configuration and profiles to your agent servers, and aggregates execution records into the reports. Passwords and license keys are stored as hashes.
| Data | Who can read it | Kept for |
|---|---|---|
| Agent definitions with titles, tags and past versions | Developers and above | Life of the agent; past versions 7 days on the Free plan, 90 days on Paid |
| Drafts | The developer who owns the draft | Until published or deleted |
| Execution records agent name and version, result code, error message, command path, duration, LLM cost | Developers, in the agent reports; administrators, in the usage report | 7 days on the Free plan, 90 days on Paid |
| Configuration agent servers, allowlist, limits, authentication, search settings | Developers or administrators, by part | Life of the account |
| Profiles LLMs, APIs, databases, MCP servers, and the name and note of a prompt profile; a secret in a profile is a sys.secret reference, not the value | Developers and above | Life of the account |
| Users email address, name, role, UI preferences | Administrators and the owner | Until the user is deleted |
| Notifications what changed and who changed it, as field names, never values | Developers and above | 90 days |
| Help messages sent from the GUI | Search2o support | One year |
Who else can see it
Search2o Cloud runs on Google Cloud Platform. Search2o staff, and Google as the provider of the underlying infrastructure, can in principle see the data stored in plain form. With the default setting the account's key is managed by Search2o, so Search2o, and Google as the infrastructure provider, can in principle read the encrypted data as well. With end-to-end encryption the key never leaves your organization, and neither Search2o nor Google can read what is stored encrypted. The privacy policy has the final word.