Skip to main content
This page is the source of truth for what DecimalAI does with your data. For a quick scan, jump to Data we store or How to delete data.

​
Data we store

For each trace sent by the SDK or API: For each manifest registered by the SDK: tool names and schemas, model names and parameters, prompt text, skill names with a hash, and the multi-agent topology as a hash.
Prompt and output text is stored as written. The SDK has no redaction setting, so scrub PII, card numbers and other sensitive text before your code records it. With manual tracing, clean what you pass to log_llm_call(). A framework adapter records what the framework sees, so keep sensitive values out of the prompts and answers you trace.

​
What we do NOT store

  • Your LLM provider keys, with one exception you opt into. A key you add under Provider keys (BYOK) powers the Playground and fine-tuning. It is stored encrypted and shown only masked. An admin adds or removes it, and any editor in the organization can run models with it.
  • Your source code. The SDK doesn’t read it. Tracing looks in your project’s skill folders (.agents/skills/, .claude/skills/ and similar) and records each skill’s name, description and hash in the manifest, not its text. Folders in your home directory, such as ~/.claude/skills/, are read only if you pass include_global=True. decimalai skills sync uploads the skills you wrote: each SKILL.md, eval.yaml and the text files under scripts/, references/, templates/ and assets/. It never uploads a skill installed from the registry.

​
Where trace text goes

Hosting is Google Cloud. Trace text reaches an LLM provider when a feature calls a model for you. On DecimalAI’s key, those are a server-side LLM judge, a suggested improvement you ask for on a skill, test prompts you generate for an agent, and call replay in mode=real. The Playground uses the key you added. The privacy policy lists our subprocessors.

​
Skills you install

A skill installed from the registry is rendered and safety-checked before it is served, and the CLI and plugin check it again before writing it. How skills are vetted covers the checks and what each band means. Skills on disk covers where files can land, how bytes are verified and which tools a skill may pre-approve. Fetching a skill sends the skill you asked for and, for skills add, install and update, the install names your project already uses so the registry can avoid a collision (never their contents). The registry keeps one count per skill and day, by route. What the registry records has the detail.

​
Encryption

  • At rest. Postgres on Cloud SQL and our Cloud Storage bucket both use Google’s default encryption at rest. Provider keys you store get a second layer: Fernet (AES-128-CBC with an HMAC-SHA256 tag), with a key held in Secret Manager.
  • In transit. Traffic is HTTPS, and HSTS is on for api.decimal.ai and app.decimal.ai.
  • API keys. Only a SHA-256 hash is stored. The dashboard shows the full key once, when you create it.

​
Retention

Manifests, skills and datasets are kept until you delete them. A daily job deletes traces older than your plan’s window, but never one younger than 30 days, so a Free trace goes at 30 days at the earliest. The window is the target we aim for. The commitment behind it is the outer bound: no trace is kept longer than 12 months, on any plan, except the traces behind a benchmark result, which stay as long as the result does. A weekly job also clears each model call’s stored messages and completion once the call is 60 days old. The trace, its final answer and the short previews stay until the trace is deleted. After that, the Playground and call replay can no longer re-run that call.

​
How to delete data

Deleting a trace removes its rows. Backups keep deleted data for up to 7 days; after that it is unrecoverable.

​
Compliance

DecimalAI is not SOC 2 certified. For a security questionnaire or a data processing agreement, email hello@decimal.ai.

​
Hosting region

Production runs on Google Cloud Platform (Cloud Run, Cloud SQL for PostgreSQL and Cloud Storage) in us-central1.

​
Reporting a vulnerability

Please don’t open a public GitHub issue. Email hello@decimal.ai with SECURITY: in the subject line, or use GitHub private vulnerability reporting on the docs repository. A PGP key is available on request. We follow coordinated disclosure and don’t run a paid bug bounty.