Data handling
What is stored
Section titled “What is stored”| Data | Notes |
|---|---|
| Events | Stored as received, with the producer’s signature. Append-only. |
| Evidence items | Network proofs such as mandates and receipts, stored as received because they are evidence. They can include names or email addresses disclosed in a credential. |
| Derived records | Verification results, mandate evaluations, screenings, alerts, baselines and cases. |
| Audit log | Every write, and every view of evidence or a pack. |
| Packs | Signed zip files in locked object storage. |
What you should not send
Section titled “What you should not send”- Card numbers. Rejected on ingest with
pan_detected. - Instruction text. Send its hash, and optionally a redacted summary.
- Personal data of EU or UK data subjects. The service is US-only for now. An event whose
owner.countryis in the EEA or UK is still accepted, and its result carries the warningeu_owner_country.
Where it lives
Section titled “Where it lives”All storage and compute run in US regions: the database in AWS us-east-1, the API and workers on Fly.io in Virginia, the dashboard on Vercel in Washington DC, and packs in S3 us-east-1. Error monitoring and email use their US regions.
Retention and deletion
Section titled “Retention and deletion”- Evidence packs are locked for seven years.
- Events and verification results are append-only and are not edited or removed by anyone. A correction is a new event.
- Daily hash-chain anchors are kept with the data they cover.
- Test environments can be deleted by an owner.
Access to evidence
Section titled “Access to evidence”Evidence values are shown only to analysts and above, and each view is recorded in the audit log. See roles and access.
Sub-processors
Section titled “Sub-processors”Infrastructure and delivery providers process data on HalvorAI’s behalf: Neon (database), Fly.io (compute), Vercel (dashboard), Amazon Web Services (evidence storage), Resend (email) and Sentry (error monitoring). A current list is available on request.