Data protection: stored copies, Task reads, and data paths
Describes Duale AI encryption at rest, copies that outlive a delete, Task read boundaries, and external data paths.
This page covers encryption at rest, unencrypted storage, copies that outlive deletion, Task data visibility, data transport paths, and external data paths.
- Data categories encrypted at rest.
- Data stored without application-level encryption.
- Copies that outlive a document deletion.
- Task data visibility across Agent Identity boundaries.
- Data transport and external data paths.
Summaries were generated by AI.
Use this page to decide which information to send. It lists how Duale AI protects each stored copy, which copies outlive a delete, which later Tasks can read your data, and where data travels. The Privacy notice states the retention periods of the data categories it lists.
What Duale AI encrypts at rest
Duale AI encrypts these categories of customer data before it stores them:
- Data category
- Stored Library documents, their extracted content, and their search data
- Protection
- AES-256-GCM encryption
- Data category
- Platform telemetry and copies used for reporting
- Protection
- AES-256 encryption
- Data category
- Database backups
- Protection
- AES-256 encryption
- Data category
- Optional user context inside an audit event
- Protection
- Encryption with a key specific to one Tenant
Duale AI manages these keys. Access to the stored files alone is not enough to read the protected content. Ask for key-management detail through the Trust Center.
Only the optional user context of an audit event uses the key of its Tenant. The rest of the event is not encrypted with that key. When a Tenant is erased, Duale AI disables that key and no longer decrypts the user context of the Tenant’s audit events.
Security and data handling defines Library restore and deletion behavior. Evidence and audit defines the meaning and limits of audit records.
What Duale AI stores without that encryption
- Data
- The file you upload, in the temporary upload area
- What happens to it
- Each uploaded file first lands in a temporary upload area. Duale AI then stores the encrypted copy. Duale AI removes the file from the upload area automatically a limited time after the upload, whether or not you delete the document. No action of yours removes it sooner.
- Data
- Public web pages and page resources read during Web research
- What happens to it
- Duale AI keeps a copy for the Tenant and reuses it for later reads in the same Tenant. It does not keep a page or resource that was requested with cookies or credentials, or that the site marks as private.
- Data
- Short-lived working copies
- What happens to it
- To extract a document, answer a read, or send an image to a model, Duale AI works on a short-lived decrypted copy and removes it when the work no longer uses it. No interface deletes a working copy on demand.
- Data
- Task history and Task events
- What happens to it
- Duale AI stores them on encrypted storage volumes, without application-level encryption. The volumes use AES in XTS mode with a 256-bit key, which gives AES-128 strength, and backups of these volumes keep that encryption.
Copies that outlive a delete
Deleting a document does not remove every copy at once:
- Copy
- The document in Recently deleted
- After you delete the document
- Stays restorable for a limited period, then Duale AI deletes it
- Copy
- The uploaded file in the temporary upload area
- After you delete the document
- Stays until its own removal time, which counts from the upload, not from the delete
- Owner
- This page
- Copy
- Task history and Platform telemetry that quote the document
- After you delete the document
- Stay for the periods that the Privacy notice states for AI content and technical traces; later Tasks of the same Agent Identity can read the requests and final answers in them
- Owner
- Privacy notice
- Copy
- Content sent to a model provider
- After you delete the document
- Follows the terms of the provider account you configure
- Owner
- Your provider account
Plan an erasure request around these copies.
What later Tasks can read
A Task can search and read the requests and final answers of earlier Tasks of the same Agent Identity, for a limited period after those Tasks ran. It cannot read their other Task history, such as Tool Calls and Tool Results. The Agent Identity is the boundary, as it is for Libraries: a Task of another Agent Identity cannot read them.
When one Agent Identity serves several end users, the Task of a later user can read what earlier users asked and received. Use one Agent Identity for each end user or trust boundary when Tasks must not see each other’s work. Context continuity owns this capability.
How data moves to and from Duale AI
HTTPS protects every customer-facing path. The Python SDK and the Dashboard add end-to-end encryption to protected Tenant operations. End-to-end encryption explains where it starts and ends and what remains visible.
Your SDK process opens every connection outbound, and Duale AI opens none back to it. Dashboard requests start in the browser. Remote MCP requests leave Duale AI instead and follow the external data paths below.
- Path
- Python SDK Task requests, results, live events, Tool Results, and Stop requests
- Protection
- HTTPS plus end-to-end encryption
- Path
- Python SDK Agent Identity Tool registration and heartbeats
- Protection
- HTTPS plus end-to-end encryption
- Path
- Python SDK Library management and document requests
- Protection
- HTTPS plus end-to-end encryption
- Path
- Dashboard protected Tenant requests, from the browser
- Protection
- HTTPS plus end-to-end encryption
- Path
- SDK and Dashboard platform-token issuance
- Protection
- HTTPS only
- Path
- SDK or Dashboard document file parts
- Protection
- HTTPS only, to a short-lived signed upload URL
- Path
- SDK telemetry export, when enabled
- Protection
- The transport of the endpoint you configure, with a separate telemetry token
Library requests reach the same origin as Task requests. File parts reach the storage host named in the upload response. SDK telemetry reaches only the collector you set.
The SDK sends telemetry to the collector and transport that you configure. DUALEAI_OBSERVABILITY__ENDPOINT accepts
any scheme, defaults to a local address, and carries your telemetry token as a bearer header. The SDK does not require
HTTPS for this endpoint, so use an https:// collector whenever telemetry leaves the host.
A signed part-upload URL is valid for six hours. Keep it out of logs and share it only with the upload process that needs it.
External data paths
A Task can send data to systems outside Duale AI:
- Path
- Selected model provider
- What can cross it
- Model input and the model response
- Path
- Public Web research
- What can cross it
- A research query or page URL, then search results and public-page content
- Path
- Public package registry
- What can cross it
- A package request, and the package bytes when Duale AI does not already hold that package
- Path
- SDK Tool Host
- What can cross it
- The Tool name and arguments sent to your host, then its Tool Result
- Path
- Remote MCP catalog check
- What can cross it
- The configured credential and request or network metadata sent to the server, followed by the Tool definitions it returns
- Path
- Remote MCP Tool request
- What can cross it
- The Tool name, arguments, configured credential, and request or network metadata sent to the server, followed by the result it returns
You choose and contract with your model providers and remote MCP services. During a Task, the model can choose public web destinations, packages, and Tool requests within the access of the Agent Identity and the Tools available to the Task. Every Agent Identity assigned to one MCP Connection uses the same configured remote principal. Duale AI does not forward the Agent Identity or the end-user identity to that server. Shared responsibility assigns the controls on each side of these paths.
Catalog checks run periodically while an MCP Connection is enabled, even when no Tool request occurs. Duale AI retains the returned Tool definitions and their last assignment context in the organization catalog. Expired definitions are not offered to a model, but disabling or deleting the Connection does not delete them permanently in this release. Operate Tools defines that lifecycle, and the Privacy notice states the current retention qualification.
Duale AI sends an image to a model provider only on a route that can carry images. Each provider request carries its whole input, including the selected Task history and its images, so an image is sent again with every request that includes it. Duale AI does not upload documents or images to the file storage of a provider and does not refer to files stored there. The provider’s retention of what a request carries follows the terms of the provider account you configure. Images explains when an image reaches a model.
Web research queries can appear in the logs and traces of Duale AI. Those records follow the retention periods in the Privacy notice. Do not put a secret in a research brief or URL.
Telemetry and the cache you run
Platform telemetry can hold model inputs and outputs, Tool arguments and results, and system or developer instructions. Treat telemetry as a processing location that holds content, and apply the retention period in the Privacy notice. Telemetry is separate from the audit log.
The @activity SDK cache is yours to run. It writes to a local SQLite file or a Redis server that you operate and does
not add encryption. Apply your storage and network controls to that cache. If the application has no @activity
function, the cache does not start.
Return to Security for the full Task lifecycle.