> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data residency, encryption & retention

> Where Enfors stores data, how it's encrypted, and how long it's kept.

## Data residency

All captured session data is stored in **AWS us-east-1 (N. Virginia)**. No data is
replicated to other regions.

## Encryption

| Layer      | Control                                                                                             |
| ---------- | --------------------------------------------------------------------------------------------------- |
| In transit | HTTPS / TLS 1.3 for all traffic — gateway (`llm.enfors.ai`) and watcher uploads (`data.enfors.ai`). |
| At rest    | AES-256 across infrastructures.                                                                     |

## Retention periods

Enfors keeps two distinct layers of data on different clocks: your **durable records** (the
decision ledger), retained by plan, and transient **platform data**, aged out on a short
fixed window.

### Your records (the decision ledger)

The durable, PII-scrubbed record of your AI activity is retained according to your plan.
Records stay queryable for the full window and can be exported at any time.

| Plan             | Records retention                          |
| ---------------- | ------------------------------------------ |
| Solo             | 60 days                                    |
| Small Teams      | 1 year                                     |
| SMB / Enterprise | Custom, with legal hold for regulated work |

### Platform data

Raw prompt/response content and operational data are transient — they age out on a short
fixed window regardless of plan.

| Data type                                   | Retention        |
| ------------------------------------------- | ---------------- |
| Ingest / gateway logs (raw prompt/response) | 14 days          |
| Database backups                            | 14 days          |
| Queue messages (main / DLQ)                 | 4 days / 14 days |

<Note>
  Raw prompt/response content lives in the ingest/gateway log layer under the 14-day window.
  The durable decision ledger is PII-scrubbed and retained per plan (above) — see
  [Data captured vs. not captured](/security/data-handling).
</Note>