Governance is what your security team actually checks: who can do what, what gets logged, how long it stays, and how to get your data out. This page is the short version. The technical depth lives on /security/architecture.
Admin roles
Every workspace has an owner, admins, and members. Owners and admins can invite, remove, and change roles for teammates; members can use Cole and view their own data. We will be adding custom roles for the Enterprise plan later this year.
Activity logging
We keep a server-side log of the API requests made for your workspace: what was done, for which workspace and when. Credential fields (tokens, passwords, API keys and similar) are redacted before anything is written. Operational application logs are retained for 14 days.
There is no audit log inside the product yet. If your review needs activity records for your workspace, email security@pocodot.ai.
Data retention
We retain customer data for the duration of your contract. When you delete your workspace, your account and its data are permanently deleted from our live database. Daily database backups are kept for 14 days and then removed, so deleted data ages out of them within that window.
Role-based access (Pocodot internal)
Internally, access to production systems and to customer data follows the principle of least privilege: only the people who run the service have it.
Connected integrations
Every integration uses the upstream vendor's official login (OAuth) with the narrowest permission scopes possible. Tokens we store are encrypted with AES-256-GCM. You can see and revoke any integration from Settings → Connected integrations. The full list of scopes Pocodot requests from each platform is documented on each integration's setup page; for Slack specifically, see the "What Pocodot sees in your Slack" section on /security.
Data export
Ask for a copy of your data through the data request form on our GDPR page, or email privacy@pocodot.ai. We send you everything Pocodot holds about you: conversations, tasks, memories and integration details.
Bring-your-own-key (BYOK) - Enterprise roadmap
Enterprise customers will be able to bring their own KMS key (AWS, GCP, or Azure) to encrypt their workspace's data. Revoking the key in your KMS makes your workspace immediately unreadable, even to us. This is on our roadmap for the Enterprise plan; talk to security@pocodot.ai if you need it sequenced into a contract.
Regional data residency
Today, all customer data lives on secure servers in Singapore. Enterprise customers can choose the United States, Europe, or Asia-Pacific. See /security/dedicated for the full Enterprise data-residency options.
Sub-processor controls
You can see every company that helps us run Pocodot at /subprocessors. We give 30 days' notice by email to your billing contact before adding any new sub-processor. Enterprise customers can require explicit written approval before any new sub-processor is added to their workspace.