Data Handling and Retention

What Intended stores for each decision, what it stores only as a digest, what it never stores, how long it keeps it, how legal holds work, and how each decision records which classifier made it.

6 min read

Data Handling and Retention#

This page describes what Intended stores when it makes a decision, what it keeps only as a fingerprint, how long it keeps records, and how to stop deletion with a legal hold.

What is stored for each decision#

Data	How it is stored
Action description (`proposedAction`), target system, actor id and type	As sent, except that any tool-call argument value found in the action description is replaced with `[arg]`, and an action description sent with `arguments` is capped at 1,024 characters
Risk flags, justification and metadata you send (up to 25 metadata keys, 256 characters each)	As sent
Tool-call `arguments`	Digest only: a SHA-256 hash and the length. The values themselves are not stored
Open Intent classification and confidence	Stored
Which classifier made the classification (see Provenance)	Stored
Decision, risk score and rationale	Stored
Authority token claims (action, target, expiry, nonce, key id)	Stored
Audit entries	Stored in a per-workspace hash chain. Any change breaks the chain and shows up on verification

Argument values stay out of the action text

Intended's integrations describe a tool call by its name and argument names only, and send the values in the arguments field:

The MCP gateway: Call MCP tool "<name>" with args: <argument names>.
The LLM gateway: tool:<name> args: <argument names> (in self-hosted deployments, tool:<name> sha256:<digest> with no arguments field).
The Claude Code hook: Call tool "<name>" with args: <argument names>.
The Python SDK (intended 0.2.2 and later): Call MCP tool "<name>" with args: <argument names> from intended.mcp and Call LangChain tool "<name>" with args: <argument names> from intended.langchain. The OpenAI Agents and PydanticAI guards keep their openai.tool.<name> and pydantic_ai.tool.<name> descriptions. None of them put argument values in metadata.

Intended reads the argument values in memory to evaluate your policies and classify the action, and stores them only as a digest. As a safeguard for older clients that still write values into the description, any argument value that appears in the action description is replaced with [arg] before anything is stored. For the same reason, /v1/agent-intent removes the metadata keys arguments, args and input, which older Python SDK versions used for argument values, before metadata is stored. An arguments object found there is evaluated like the arguments field. So explain_decision, receipts and decision webhooks never return argument values. Text you write yourself in an action description (for example with submit_intent or the SDK) is stored as written, so keep secrets and personal data out of it.

Plain-English requests#

Plain-English intake (/intent/compile, /v1/classify, webhooks that carry text, the simulator) is off unless it is set up for your workspace.

Data	How it is stored
The request text	Digest only (SHA-256 and length), in the compilation record and in the run log
The full request text	Only if raw prompt logging is turned on for your workspace. It is off by default. When on, the text is first redacted, then encrypted with a key specific to your workspace (AES-256-GCM)
The classification result (action, confidence, rationale, alternatives)	Stored with the compilation record. If AI-assisted classification is on, this is the model's answer

Redaction replaces these patterns before the text is stored: email addresses, common API key formats (sk_live_…, sk_test_…, GitHub tokens), JSON Web Tokens, AWS access key ids, US social security numbers, card numbers, IPv4 addresses and long base64 strings, plus any custom patterns set up for your workspace. Redaction applies to what Intended stores. It does not change the text sent to an AI model when AI-assisted classification is on. See How Intended Uses AI.

Your third-party credentials#

Intended decides and signs. It never holds your keys or calls your systems. Your agent performs every action with its own credentials, so Intended stores no customer credentials for third-party systems and receives no output from the actions your agents take. If you report an outcome (POST /intents/:id/outcome), Intended stores the outcome you send.

What Intended does not store#

AI policy drafting: neither your description nor the draft. Only rules you save.
The LLM gateway: your prompts and the model's responses. Only each tool call's decision request is recorded, as described above.
The MCP gateway: the upstream MCP server's results. They go straight back to your assistant.
Your model provider keys passed through the LLM gateway. They are forwarded to your provider and never stored.
Credentials for the systems your agents act on. Intended never asks for them.

Retention#

Records are kept for the window your plan sets, then deleted by a daily job.

Plan	Retention
Free	30 days
Platform	1 year
Enterprise	A custom window up to 7 years. If none is set, 7 years

How deletion works:

The cut-off is rounded down to midnight UTC, so a record is never kept for less than the promised window.
If Intended can't work out a workspace's plan, it skips that workspace for the day rather than using a shorter window.
The audit chain is shortened only from its oldest end, so the entries that remain still verify.
Deletion covers decisions and audit entries, plain-English compilation records and encrypted prompts, run logs, approvals and escalations, gateway decision records, and related analysis records.

Legal holds#

A legal hold stops all deletion for a workspace while it is active. Holds can be placed with POST /assurance/legal-holds, which needs the evidence:export permission. A hold covers the whole workspace, not individual records.

Provenance#

Each decision made through /v1/agent-intent or /intent (which includes the SDK, the MCP server and both gateways), and each plain-English compilation, records which classifier made the classification:

Classifier backend: rules (the deterministic classifier), llm-api (AI-assisted classification) or local-model.
Classifier version: the rule set and engine version that ran.
Knowledge pack version: the version of the classification data that was loaded.

This lets you show, for any past decision, whether AI was involved and exactly which version of the rules classified it. Every decision path records them, including the enforcement gateway and physical-AI requests (where no classifier runs, the receipt says so and still names the rule set), and each receipt carries them, sealed into its tamper-evident hash.

Older records#

Before October 2026, Intended stored the full plain-English request text and, for actions it then ran on a customer's behalf, their full output. Those older records were not rewritten. They are deleted on the normal retention schedule above.