Data handling

What Ony.ai stores, where it lives, how long it is kept, and what it deliberately does not store. This is the reference for a privacy review or a DPA. Ony.ai is open source and self-hostable: when you self-host, the data lives entirely in your own database and never reaches Ony.ai.

What is stored

Data	Where	Notes
Organizations, users (email, name, hashed password, role, timezone)	Postgres	Passwords are PBKDF2 hashes, never plaintext.
Phone number (for calls and SMS)	Postgres	Masked in logs and in the dashboard’s team view.
Linked chat IDs (Telegram, Slack)	Postgres	Only to route escalation approvals.
TOTP secrets	Postgres	Encrypted at rest (Fernet, key derived from the signing secret).
Handoffs: action type, server-derived risk, title/summary, options, decision	Postgres	The spoken and notified surface is the closed taxonomy only.
details payload (a diff, log, or command an agent attached)	Postgres	Sensitive; shown only in the authenticated dashboard; scrubbed by retention.
Audit chain (who did what, when)	Postgres	Append-only, HMAC-chained, tamper-evident.
Rate-limit windows, in-flight IVR/call state	Valkey (or in-memory)	Ephemeral coordination state, not a system of record.

What is deliberately NOT stored or exposed

• Call audio and transcripts. Inbound voice turns are processed for the reply and never written to the audit chain; the voice agent works from a redacted snapshot (counts, action types, risk), never raw content.
• Raw payloads over voice, SMS, or chat. These channels carry only the server-authoritative action and risk plus a redacted gist; the full details blob is never spoken, texted, or put in a chat message.
• Secrets in the audit chain. The tamper-evident audit metadata never contains the details blob, the raw command, or tokens.
• The client’s risk claim. The agent’s suggested risk_level is discarded; risk is re-derived server-side. See the risk and policy model.

Where data flows (sub-processors)

Self-hosted Ony.ai talks only to the providers you configure:

• Telephony (SignalWire, Twilio, Telnyx, Plivo): receives the callee’s phone number and the spoken action-and-risk text to place the call or SMS. No payload content.
• LLM (optional; OpenAI, Anthropic, and others): the voice agent and the payload summarizer. The summarizer sends redacted input, with secrets stripped before egress. Set ONY_LLM_PROVIDER=none to disable all LLM calls; the deterministic paths still work.
• Email (optional SMTP relay): password-reset, invite, and welcome mail.
• Identity (optional OIDC IdP): email, name, and group claims for SSO.

No analytics or telemetry is sent anywhere. The /metrics endpoint is PII-free (closed-enum labels only) and internal.

Retention and deletion

• Payload retention: ONY_DETAILS_RETENTION_DAYS (default: keep). A daily sweep scrubs the large details payload (and its derived gist) off handoffs older than the window, keeping the metadata and the audit chain. This minimizes how long sensitive content is retained.
• Member deactivation: removing a member is a soft delete. Their access is revoked and their seat freed, but the row is retained so the audit trail stays attributable and verifiable.
• Right-to-erasure: DELETE /api/v1/org (admin only) permanently deletes the entire organization and everything under it (users, devices, handoffs, calls, and the whole audit chain) via database cascade. Irreversible. The request body must carry confirm set to the org slug plus a fresh step-up proof (password or a current authenticator current_code), so a stolen session token alone cannot erase a tenant. On the cloud edition the Stripe subscription is cancelled first; if that fails, nothing is deleted.
• Backups: if configured, encrypted Postgres backups are retained per ONY_BACKUP_RETENTION_DAYS. Factor them into an erasure request.

See the configuration reference for the full list of retention variables.

Tenant isolation

Every data path is scoped to the caller’s organization_id; cross-tenant reads are impossible by construction. Roles (admin, member, viewer) gate what a member can do within their own org.