Security and trust Storage and encryption
Storage and encryption
This page says how Oxelone holds your workspace's data. It states what the product's code and the legal page establish, and no more.
Where it is held
Workspace data is stored in data centres in Frankfurt, Germany, inside the European Union. Where a subprocessor handles personal data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses. The subprocessors are listed on the legal page.
In transit
All traffic between your machines, the console and Oxelone's servers is encrypted in transit. The console sets one cookie, which keeps you signed in. It is HttpOnly, so scripts on the page cannot read it, it is SameSite=Lax, and it is marked Secure when the console is served over https.
Credentials for connected platforms and providers
Credentials your workspace gives Oxelone are encrypted in the database with XChaCha20-Poly1305, under a 256-bit key that the deployment supplies in OXEL_CREDENTIAL_KEY. There is no default key and none in the code. This covers:
- the credentials of a connection to a platform such as GitHub or Microsoft 365
- the API keys of model providers
- a single sign-on client secret
- the token or signing secret of a log stream
- the originals held under the Restricted redaction mode
Each sealed value is bound to the row it sits in, so a value copied into another row does not open. A deployment with no key cannot store one: the console refuses, and says that a secret is never stored unencrypted. Under Restricted, a deployment with no key stores Permanent instead.
Secrets are write-only. After you save one, the console shows only its last four characters, so you can compare it with your provider's console. Nothing reads it back.
The key lives in the deployment's environment. It protects against a stolen database backup or a query in a log; it does not protect against someone who can read the host's environment.
Passwords, keys and codes
| What | How it is stored |
|---|---|
| Passwords | A hash made with Argon2id. Passwords must be at least 12 characters. |
| API keys | Only a SHA-256 hash. The key is shown once, when you create it. |
| Install tokens and removal keys | Only a digest. The install command and the removal key are each shown once. |
| Sign-in codes and password resets | Only a SHA-256 hash. A code lasts 10 minutes. A reset link lasts 30. |
| Sessions | A token in the cookie above; the server keeps its hash. |
What is kept, and for how long
| Data | What it is | Kept |
|---|---|---|
| Accounts | Name, email address, role, a hash of the password, sign-in codes and session records. | While the account exists |
| Machines | Machine name, operating system, the AI tools found on it and their settings, as the agent reports them. | While the machine is enrolled |
| Interactions | Prompts, responses and uploads the agent inspects. Your workspace decides whether text is stored, and how stored text looks where PII and secrets were found. | Your workspace's logging setting and retention window |
| Connector records | Settings and metadata from the platforms you connect. File contents and chat text are never stored. | While the connection exists |
| Alerts, issues, audit log | What your policies raised, and who did what in the console. | The retention window you set, up to the limits on Retention |
You choose the logging mode on Interaction logging and the windows on Retention. When an agreement ends, you can export your data for 30 days. After that, Oxelone deletes your workspace.
Releases
Agent releases are signed, and the agent checks the signature before it updates itself.