Data handling and retention

Kept, and never kept

Kept	Never kept
Source metadata (site, document identifier, version) so a later question can re-check access. Audit records: who asked, when, which sources were used, what changed and its outcome. Conversation state for follow-up questions, for a bounded time. Usage counts for the monthly ceiling.	Document text — in the database, logs, analytics or error messages. Access tokens beyond the request that uses them. Secrets of any kind, in logs.

Retention schedule

Data class	Default retention	Deletion behaviour
Original SharePoint files	Remain in your SharePoint	Offboarding never deletes your originals.
Transient downloads and previews	At most 24 hours	Deleted on expiry or on disconnect.
Conversation state	30 days (configurable lower)	Deleted on user or admin request, subject to any agreed holds.
Operational logs	30 days; no raw document text	Automated expiry.
Audit and usage ledger	12 months	Retention as your agreement specifies; exported or deleted at offboarding.
Database backups	35 days rolling	Deleted records age out through the backup lifecycle.
Optional index / extracted text	While connected and authorised	Purged within 24 hours of disconnection.

All product data lives in your own cloud account, under your control. Your Microsoft 365 and Teams retention operate separately from Knovara; we do not promise deletion from Microsoft-controlled histories or backups we do not control.

Prompt safety

Everything retrieved from a document is treated as untrusted data, never as instructions. Instructions embedded in a document ("ignore your rules", "email this file") are not followed; an answer has no ability to send mail, share files, or call any tool.

See also the disconnect and offboarding document, and the privacy notice.