Privacy Policy
Last updated: March 31, 2026
What We Collect
| Data | Source | Purpose |
|---|---|---|
| Name, email, profile picture | Google OAuth | Account identity |
| Session tokens | Generated on sign-in | Authentication |
| Organization membership | Auto-created from email domain | Tenant isolation |
| Deployment history & audit logs | Generated by your actions | Operations & compliance |
| Blueprint configurations | Created by your team | Infrastructure governance |
What We Do NOT Collect or Store
- Cloud credentials — AWS access keys, Azure service principals, and GCP service accounts are provided per-operation and discarded after use. They are never written to our database.
- Your application code or data — AskArchie manages infrastructure resources only. We do not read, copy, or access data inside your cloud resources.
- Passwords — Authentication is fully delegated to Google OAuth (and soon Microsoft Azure AD). No passwords are stored.
Where Data is Stored
- All platform data is stored in AWS DynamoDB in the us-east-1 region.
- Data is encrypted at rest (AES-256, AWS-managed keys) and in transit (TLS 1.2+).
- Pulumi infrastructure state files are stored in AWS S3 with tenant-isolated paths and versioning enabled.
Data Isolation
Every record in our database includes a tenant identifier. Data is isolated between organizations at the application and database layer. No API endpoint returns data across tenants. Your organization's data is only accessible to members of your organization.
Third-Party Sharing
We do not sell, share, or provide your data to third parties. The only external services involved in the platform are:
- Google OAuth — for authentication (name, email, profile picture)
- AWS — infrastructure hosting (DynamoDB, S3, Lambda, CloudFront)
- Slack — optional notifications to your configured channels (you control which events are sent)
Data Retention
- Audit logs are retained indefinitely (configurable TTL available).
- Deployment history is retained for the lifetime of the stack.
- Session data expires after 30 days of inactivity.
Your Rights
- You can export your audit logs at any time (JSON or CSV) from the admin panel.
- You can request deletion of your account and associated data by contacting us.
- Organization owners can remove members and manage data access within their tenant.
Contact
Privacy questions? Contact us at security@askarchie.io