Data flows and retention
Exactly what stays on the endpoint, what the console and Query API store and return, what the relay sees, how long each keeps it, and the security log schema.
The short version
Raw collected data stays on the endpoint. A small amount leaves it: findings with the few indicators needed for correlation, and the answers you ask for. On the Recursift-hosted service those answers are stored until deleted. On a customer-hosted server everything below stays on your server.
On the endpoint
The endpoint keeps its sealed local archive, the full results behind each answer, and its signed audit log, each with the bounds listed in Data retention. The endpoint security log is written locally; choosing that output format does not change what the endpoint sends to the console.
What the console stores
| Record | Fields that can hold sensitive content | Kept |
|---|---|---|
| Question | question text, check arguments, answer, requested rows, tool calls, error | Until the conversation or question is deleted |
| Conversation | title | Until deleted |
| Event | summary, attributes, matched rules, verdict and its summary | No expiry; the console cannot delete events |
| Endpoint | latest profile and heartbeat fields | Latest values only |
The console deletes an endpoint's conversations and questions when you ask it to. It has no automatic retention period for these records.
What the Query API stores
| Record | Fields | Kept |
|---|---|---|
| API key | hash of the key, prefix, scopes, expiry, revocation time, request counters. Never the key itself. | No expiry of the record |
| Query job | question, request hash, idempotency key, status, deadline | No expiry |
| Query target | endpoint ID, hostname, status, answer, error | No expiry |
| Audit event | event JSON in a per-customer hash chain | No expiry; append-only |
Each question the API sends also becomes a console question record. For API questions, a database trigger discards requested rows, and answers returned by the API are cut to 4,000 characters and errors to 500. Every API table is limited to the calling customer by row-level security.
What the Query API returns
| Request | Response content |
|---|---|
| GET /v1/me | Calling key ID, customer ID and scopes |
| GET /v1/agents | Allowlisted metadata only: id, hostname, platform, last_seen_at, status |
| POST /v1/queries | 202 receipt: id, status, agent_total, deadline. No answer. |
| GET /v1/queries/{id} | Counts, findings (agent_id, status, answer, error, answered_at) and unanswered_agents |
| GET /v1/findings?search= | Substring search over answers already retrieved through the API; not a negative hunt result |
| GET /v1/audit/events | seq, event_json, prev_hash, hash |
Checked against OpenAPI 0.1.0 at api 92e785d, the same file as the OpenAPI download on this site. There is no raw-evidence route.
Ephemeral results on the hosted service
Planned, not built: an ephemeral mode that keeps only request metadata (an opaque request ID, the actor, the operation, timestamps, status and bounded counts) and keeps questions, answers and evidence out of hosted storage, logs and caches. api#5 owns the API and MCP mode, webapp#16 owns the console views, and agent#118 owns qualification.
What the relay sees
The relay holds connections in memory and stores nothing. It carries presence checks and signed peer findings between endpoints of the same account. It measures a finding's length but does not parse, change or log it, and it does not log credentials, nonces or indicator values. Findings are signed, not encrypted end to end: TLS protects each hop, and whoever operates the relay can read the indicators inside a finding. On a customer-hosted server that is you.
On a customer-hosted server
The console, Query API, relay and application database run on your server, so every record above stays there. The console refuses outbound requests beyond its own origin and loopback, and the application services are limited to loopback traffic. Backups contain the whole database and every secret; see Back up, restore and remove.
Security log schema
The endpoint security log targets OCSF 1.9.0, and every record sets metadata.version to 1.9.0. It uses three classes: Base Event (class 0) for source observations and sensor health, Detection Finding (class 2004) for positive assessments, and Process Activity (class 1007) for launch and terminate. Severity stays Unknown (0) until there is a justified classification.
Retention policies
Endpoint stores have the bounds in Data retention. The console and Query API keep records until they are deleted, except finished gold build tasks, which are removed after 30 days. A customer-hosted server follows the same rules on your own database, and its backups and system logs follow your policy.