# Data and privacy

> What SpectrAI keeps from a pentest, how test accounts and evidence are protected, what is purged, where inference runs, and what SpectrAI does not promise.

## Isolation between clients

Each client space is a boundary: every read and every write goes through the current space and rules enforced in the database. A partner only accesses its spaces; an analyst only the assigned spaces; a client contact only their own.

## What is kept

| Data | Retention |
|---|---|
| Targets, ownership proofs, Guidance and its documents | Kept with the client space, versioned. |
| Activity events of a pentest | Normalised and redacted before being recorded. |
| Findings and evidence | Redacted, then frozen in the report. |
| Reports | Immutable snapshots, with their PDF. |
| Audit log | The actions of the space. |

## Test accounts

Test accounts provided for a pentest are encrypted at rest, materialised just before execution, redacted from evidence and purged afterwards.

> [!WARNING]
> During execution, they are readable in clear text by the test engine and by the language model that drives it. No promise of erasure at the model provider or on storage media is possible. Use dedicated, revocable accounts.

## What never reaches your space

Internal working paths, execution identifiers, image digests, provider secrets and the raw artefacts of the engine are never exposed in the client space, reports or exports.

## Language models

The agents are driven by language models accessed through a gateway, with a provider imposed per profile, training on your data refused by the gateway policy and a consumption cap per pentest. SpectrAI does not promise that the provider retains nothing, nor inference located in the European Union, nor a "sovereign" character: these properties are not attested today.

## Deletion

Deleting data triggers a storage purge, followed by a scheduled task. A confirmed purge does not prove erasure from backups nor from subcontractors' systems.

## Report sharing

A share link expires on the chosen date and can be revoked at any time. Shared report pages are neither indexed nor cached by browsers.

## Subcontractors and rights

The list of subcontractors, the purposes, the legal bases and your rights are described in the [privacy policy](https://spectr-ai.eu/en/confidentialite). The terms of use specify the authorised targets and acceptable use (see the [terms](https://spectr-ai.eu/en/conditions)).

---

https://docs.spectr-ai.eu/en/compte-et-securite/donnees-et-confidentialite