Sovereignty and data
Olympusx AI is built to run where your data must stay: on clusters you own, in a network you control, with no route to the internet if you choose. This page explains where data lives, the specific connections through which it can leave, and how long it is kept.
Where your data lives
Section titled “Where your data lives”Everything Olympusx AI stores, it stores on your infrastructure:
| Data | Where |
|---|---|
| Tenants, people’s roles, keys (as hashes), budgets, usage, runs, conversations, approvals, scores, the audit log | The platform database |
| Documents, uploads, model artifacts | The platform’s object store, and your container registry for model weights and runtime images |
| Knowledge: chunks and their vectors | The tenant’s vector databases |
| Traces, when tracing is on | The platform’s tracing store, inside the installation |
| Credentials for clusters, connectors, tool servers, code hosts and providers | The platform database, sealed with the installation’s master key |
Models run on the clusters you register. Prompts, answers and documents are processed there and nowhere else, unless you connect something outside.
Olympusx AI does not call home
Section titled “Olympusx AI does not call home”No part of Olympusx AI reports to Olympusx.ai: no telemetry, no licence check, no update check. The platform installs and runs with no route to the internet. Model weights and runtime images reach an air-gapped network through your registry, carried in by hand or fetched by a bastion host you run outside the cluster; Olympusx AI calls the bastion, never the other way round. See Air-gapped installation and Remote access.
The only ways data leaves
Section titled “The only ways data leaves”Data leaves your network only through a connection someone set up on purpose, in the console, where it stays visible:
| Connection | Set up by | What leaves |
|---|---|---|
| External model provider (OpenAI, Anthropic, Oracle OCI Generative AI, another OpenAI-compatible endpoint) | Platform admin, then granted per tenant | The prompts and answers of calls to that provider’s models. |
| Tool server at a public address | Tenant builder | What an agent sends to that tool. |
| Code host (GitLab, GitHub, Bitbucket) | Tenant admin | Reads of repositories and, for merge request review, review comments posted back. |
| Log store (OpenSearch, Loki) | Tenant admin | Queries an investigation runs. |
| Pipeline source (a URL, an S3 bucket, an NFS share, an SFTP server) | Tenant builder | Reads of documents. |
| Mail relay | Platform admin | Invitations and notifications. |
| Your identity provider | Platform admin | Sign-in. |
A tenant whose data must not leave is a tenant that is granted no external models, and whose builders’ tool servers are inside your network.
How long data is kept
Section titled “How long data is kept”Records are kept until your platform administrator sets a retention window for their class. The audit log, usage, assistant conversations, agent runs and sessions, Security assessments, investigations and merge request reviews start at keep forever, because a default window would delete records nobody chose to delete. Captured gateway turns are the one exception: they are production prompts, kept only when a tenant turns capture on, and they start at 30 days.
A daily sweep applies the windows. Usage that belongs to a billing period not yet stated is never deleted, and trimming the audit log leaves an anchor so the rest of the chain still verifies. See Data retention.
Erasing a person
Section titled “Erasing a person”A tenant admin can erase one person’s conversations and captured turns on request, with a receipt of what was destroyed and what the law requires be kept. Erasure finds a person by a reference, so it works only if the reference was recorded:
- Over the gateway, send the OpenAI
userfield with the opaque handle your application uses for the person. See Chat completions. - Through an assistant’s share link or its API, pass
endUserRef, oruin the link. With neither, Olympusx AI issues a reference for each conversation. See Agents and assistants over the API.
The reference must not itself be personal data: no email address, at most 200 characters. See Erasure.
Worldwide
Section titled “Worldwide”Olympusx AI assumes no country. Times are kept in UTC, the platform currency is chosen in Settings, and the console is in English, French and Arabic. Recognisers for national identifiers are optional packs a platform administrator registers for the jurisdictions you need.