Data Protection Policy

1. Purpose and scope

This policy states how CoherentAI protects personal data: the principles it is held to, the technical and organisational measures actually implemented in the service, and the process for exercising your rights. It complements the Privacy Policy, which describes what is collected and why.

It covers everyone with an account, every record stored by the service, and everyone who administers a deployment of it.

2. Roles

The organisation that issued your account is the controller: it decides which accounts exist, which providers are configured, and how long data is kept. Whoever operates the deployment acts as processor, handling data on the controller's documented instructions. Model providers, search, notebook, and repository services are sub-processors, engaged only when the corresponding feature is used.

3. Principles

• Lawfulness and transparency — data is processed on a stated basis, and the Privacy Policy says what happens to it.
• Purpose limitation — data collected to run the service is not repurposed for advertising, resale, or training our own models.
• Minimisation — the service asks for a username, an optional email, and a password. It does not collect a phone number, a location, or a device fingerprint, and it ships no analytics.
• Accuracy — you can correct your profile, and administrators maintain account records.
• Storage limitation — retention periods are defined in section 6 and enforced by a scheduled job for task evidence.
• Integrity and confidentiality — the measures in section 4.
• Accountability — administrative actions are written to an append-only audit log.

4. Technical measures

Credentials

• Passwords are stored as salted scrypt hashes and compared in constant time; the service can never reveal a password, only reset it.
• Administrator-issued passwords are temporary and must be replaced before the account can reach anything else.
• Provider API keys are encrypted at rest with AES-256-GCM, with the user and tenant bound into the ciphertext as additional authenticated data, so a record cannot be replayed under another account.
• Server-configured provider keys stay on the server; the client is told only whether one exists.

Sessions and transport

• Sessions are HMAC-signed cookies verified on every request, so an edited or forged cookie cannot mint a session.
• The cookie is HttpOnly, SameSite=Lax, and Secure in production, and expires after 30 days.
• Every route except sign-in and these legal documents is behind an authentication check that runs before the request reaches any handler.
• Database connections use TLS with full certificate verification.

Isolation

• Every stored record carries a tenant and a user, and queries are scoped to both; deleting a tenant or user cascades to their records.
• Two roles only — member and master admin — so account management is restricted to the accounts that need it.
• Workspace files stay in the browser's own storage until an action requires sending them.
• Workspace code runs in a Web Worker with no network, no DOM, and no storage, under a wall-clock timeout and an output cap, so a script cannot call the app's API with your session.

Evidence

• Task events are append-only: history can be added to, not rewritten.
• Account-management and task actions are recorded in the audit log with actor, target, action, and time.

5. Organisational measures

• Access follows least privilege — administrator rights are granted only where account management is part of the job.
• Secrets live in the deployment environment, never in source control; the repository ships an example file with empty values.
• Changes reach production through version control and review, with database migrations applied by a tracked runner.
• Sub-processors are added only when the feature that needs them is enabled, and are listed in the Privacy Policy.
• Anyone with administrative access is expected to know this policy and report suspected incidents immediately.

6. Retention

A task that is still queued, running, blocked, or cancelling keeps every event it has produced, however old, because that history is what explains what the task is doing right now.

7. International transfers

Data is stored in the region the deployment's database is hosted in. Requests you send to a model provider are processed wherever that provider operates, which may be outside your country. Where transfers are restricted by law, they rely on the provider's standard contractual clauses or an equivalent safeguard. Choosing a provider in Settings determines where your prompts are processed.

8. Your rights and how to use them

You may request access to your data, correction, deletion, a portable export, restriction of processing, or object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it — revoking a device stops push notifications.

• Send requests to hi@coherenttoday.com from the address on your account, or ask your administrator.
• We acknowledge within 5 working days and respond within 30 days, extendable once for a complex request, with notice.
• Requests are free unless manifestly unfounded or repetitive.
• Identity is verified before data is released; if we cannot verify it, the request is refused with reasons.
• You may complain to your local supervisory authority at any time.

9. Incidents and breaches

Suspected breaches are reported to the operator immediately on discovery and are triaged the same day: contain, assess what data and whose, then remediate.

• Where a breach is likely to risk people's rights, the supervisory authority is notified without undue delay and, where required, within 72 hours of becoming aware.
• Where the risk is high, affected users are told directly, in plain language, with what happened and what to do.
• Every incident is recorded with its timeline, impact, and the fix, and credentials that may have been exposed are rotated.

10. Deletion and offboarding

When an account is deleted, its settings, threads, notebooks, memory, devices, and notification preferences are removed with it. Audit entries may retain the identifier of a deleted account where accountability requires it. Data already transmitted to a model provider is deleted according to that provider's policy — the service cannot recall it.

11. Review

This policy is reviewed at least annually, and whenever the service changes what it stores, adds a sub-processor, or alters a retention period. The date above records the last revision. Questions go to hi@coherenttoday.com.