Data handling
Where your content goes, and where it does not.
Where content lives
One PostgreSQL database. Content, search indexes, memories, users, settings and audit records are all in it — there is no second store to secure separately.
Self-hosted, that database is yours. Managed, it is ours.
What leaves the instance
Indexing: nothing. The embedding model runs locally, so content is never sent anywhere to be made searchable. This is the default and needs no configuration.
Chat and tagging: only if you configure a provider. Then the relevant text goes to the provider you chose, using your key. Point it at a self-hosted model and nothing leaves at all.
Connectors: reach out to the systems they sync from. That traffic goes to your systems, not to us.
That is the complete list.
Deletion
Removing a connector removes its content from search. Archived content stops appearing but is recoverable, which is what makes accidental removal survivable.
Self-hosted, permanent deletion is yours to perform at the database level.
Personal data
Connectors bring in whatever the source contains, including names, addresses and anything people wrote. LensHub does not classify or redact it.
If your sources contain personal data, the LensHub instance does too. Scope connectors accordingly, and remember that access profiles and ownership are the controls for who can reach it.
Regulated environments
The properties that usually matter:
- The whole system runs on infrastructure you control
- It can run with no external network calls
- Content is never sent anywhere for indexing
- Per-user visibility is enforced in the query layer
- Administrative and authentication actions are recorded