Data handling
Where your content goes, and where it does not.
Where content lives
One PostgreSQL database. Content, search indexes, memories, users, settings and audit records are all in it — there is no second store to secure separately.
Self-hosted, that database is yours. Managed, it is ours.
What leaves the instance
Indexing: nothing. The embedding model runs locally, so content is never sent anywhere to be made searchable. This is the default and needs no configuration.
Chat and tagging: only if you configure a provider. Then the relevant text goes to the provider you chose, using your key. Point it at a self-hosted model and nothing leaves at all.
Files attached to a chat message (the paperclip) go to the provider with that message and are kept with the conversation so follow-up questions can use them. They are not added to the knowledge base, and deleting the chat deletes them.
Connectors: reach out to the systems they sync from. That traffic goes to your systems, not to us.
That is the complete list.
Deletion
Removing a connector removes its content from search. Archived content stops appearing but is recoverable, which is what makes accidental removal survivable.
Operational records are deleted on a schedule: finished jobs after 14 days,
failed jobs after 90, and search logs, tool-call records, agent sessions, the
audit log and authentication events after 365. Self-hosted, each window is a
RETENTION_*_DAYS setting. Content itself is never removed by this.
Self-hosted, permanent deletion of content is yours to perform at the database level.
Personal data
Connectors bring in whatever the source contains, including names, addresses and anything people wrote. LensHub does not classify or redact it.
If your sources contain personal data, the LensHub instance does too. Scope connectors accordingly, and remember that access profiles and ownership are the controls for who can reach it.
Regulated environments
The properties that usually matter:
- The whole system runs on infrastructure you control
- It can run with no external network calls
- Content is never sent anywhere for indexing
- Per-user visibility is enforced in the query layer
- Administrative and authentication actions are recorded