> ## Documentation Index
> Fetch the complete documentation index at: https://docs.velatir.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Storage & Encryption

> What Velatir stores, how it is encrypted at rest, and how customer-held keys decrypt only in the browser.

## What Velatir Stores

For every interaction, Velatir keeps the context it needs to monitor AI usage and produce an audit trail. The raw prompt is reviewed in memory. It is written to storage only if you choose **When flagged** or **Always** — under **Never**, it never hits disk. See [Data privacy](/security/data-privacy) for those settings and for retention.

| Always kept                                       | Kept only if you opt in                                    |
| ------------------------------------------------- | ---------------------------------------------------------- |
| The generalized **Description**                   | The content of prompts and responses (the **Context** tab) |
| Which service was used, and the trace direction   | Function arguments and detailed metadata                   |
| Agent assessments and outcomes                    |                                                            |
| Timestamps and the workspace the trace belongs to |                                                            |

## Encryption at Rest

All stored data is encrypted at rest — summaries, metadata, and any raw session content — whether or not you bring your own key.

The disk encryption is **AES-XTS-plain64** with **SHA-256** and a **512-bit** key size.

## Encryption in Transit

All traffic to Velatir is encrypted with TLS.

## Your Own Keys

Optionally, encrypt stored session content with a key your organisation holds. Velatir keeps only the public key. The private key never leaves your side, and content is decrypted in the browser. Each stored field is encrypted with AES-256-GCM; the content key is wrapped with your RSA public key (RSA-OAEP).

<CardGroup cols={2}>
  <Card title="Your keys" icon="key-round">
    Create an encryption key in **Settings → General → Data & privacy**. Only the public key is stored by Velatir.
  </Card>

  <Card title="Decrypt in the browser" icon="lock-keyhole">
    Open a trace, go to **Context**, and choose **Decrypt**. Paste or upload your private key. Velatir never receives it.
  </Card>
</CardGroup>

<Steps>
  <Step title="Create a key" icon="plus">
    In **Data & privacy**, choose **Create encryption key**. The key pair is generated in your browser. Give it a label and generate it.
  </Step>

  <Step title="Save the private key" icon="download">
    Copy it or **Download .pem**. It is shown once. Confirm with **I have saved my key**.
  </Step>

  <Step title="Activate it" icon="toggle-right">
    **Activate** the key so new stored content is encrypted to it. The badge reads **Encryption enabled**.
  </Step>

  <Step title="Decrypt when you need to read it" icon="lock-open">
    On a trace, the Context tab shows **Context encrypted**. Choose **Decrypt**, paste or upload the `.pem`, and optionally **Remember on this device**. The content is decrypted locally as **Context decrypted**.
  </Step>
</Steps>

<Note>
  Customer keys protect **stored** Context. Velatir still reviews the interaction in order to apply your agents. The Description, service, timestamps, and assessments are not encrypted to your key — they stay available so the product can show activity.
</Note>

<Warning>
  If the private key is lost, stored Context cannot be recovered. A key cannot be deleted while encrypted traces still reference it. **Deactivate** stops using it for new traces; it does not unlock old ones.
</Warning>

## Tenant Isolation

Every organisation's data is separated at the data layer. Your traces, sessions, and settings are scoped to your organisation, and there is no path for one organisation to reach another's data.

## Retention

If you set a bounded [data retention period](/security/data-privacy#how-long-data-is-kept), records older than that window are deleted automatically each day. That includes the Description, assessments, and any stored raw content. The default, **Always**, does not delete on a schedule.

Changing to a bounded period waits seven days before the first deletion. Settings shows the next deletion date.

## Data Exports

You can request an export of your data under **Settings → Data exports**. This supports your own record-keeping and helps you respond to data subject requests under GDPR.

***

<CardGroup cols={2}>
  <Card title="Data privacy" icon="shield" href="/security/data-privacy">
    Storage modes, summaries, retention, and access controls.
  </Card>

  <Card title="Organisations & workspaces" icon="building" href="/platform/organizations-and-workspaces">
    How your account is structured.
  </Card>
</CardGroup>