Data retention
This page describes how long each type of data is kept in the Autonomous Inbox.
Active workspaces
| Data type | Retention |
|---|---|
| Emails | 12 months |
| AgentRuns | 12 months |
| SystemEvents | 12 months |
| WebhookDeliveries | 12 months |
Raw .eml (S3) | 12 months |
| Workspaces, Inboxes, Agents, Webhooks | Indefinitely |
A daily cron job hard-deletes Email, AgentRun, SystemEvent and WebhookDelivery rows older than 12 months. A workspace may lower this window (never raise it) via metadata.retention_months.
Right to erasure
DELETE /v1/emails/{id}?hard=true soft-deletes the email immediately and queues a hard-delete (including the S3 object) within 30 days.
Encryption
Data is encrypted at rest (Postgres and S3 with KMS) and in transit (TLS 1.2+ on every endpoint, plus mTLS on /v1/*). Webhook signing secrets and other sensitive fields are additionally encrypted at the application layer with AES-256-GCM via KMS.
The retention windows above may change at any time.