Credentials, encrypted
Vault credentials use AES-256-GCM with authenticated additional data (AAD) binding the ciphertext to its context.
Security / 01
Clear controls for the credentials, rows, and agent connections that power your work.
01 / Batch inputs
2 hours
Auto-purged after the run reaches a terminal state.
02 / Batch outputs
7 days
Output content is automatically purged after the retention window.
03 / Hosted Lists
Your choice
Plan-based expiry or an explicit purge when you no longer need a list.
Data lifecycle
Batch inputs are automatically purged two hours after a run reaches a terminal state; batch outputs are purged after seven days. Operational metadata, such as counts and costs, is retained separately. Hosted Lists have their own plan-based retention, and you can request their removal using the purge_lists tool.
| Data | Retention | Control |
|---|---|---|
| Batch inputs | 2 hours | Automatic purge after terminal state |
| Batch outputs | 7 days | Automatic purge after terminal state |
| Hosted Lists: Free | 2 hours | Expiry or purge_lists |
| Hosted Lists: Pro | 7 days | Expiry or purge_lists |
| Hosted Lists: Scale | Forever | Retained until deleted |
Controls in practice
Sorzio uses encrypted credential storage, scoped agent authorization, restrictive data access policies, and outbound request controls. These safeguards cover different points in the lifecycle: storing a provider key, connecting an assistant, accessing workspace data, and fetching a public website for enrichment.
Vault credentials use AES-256-GCM with authenticated additional data (AAD) binding the ciphertext to its context.
OAuth 2.1 and PKCE S256 protect agent authorization. Restrictive deny_agent_tokens row-level security policies isolate direct data access.
An outbound SSRF egress firewall blocks prohibited destinations when Sorzio fetches external resources.
Empra Consultancy LTD operates Sorzio in compliance with GDPR and UK GDPR. Our privacy and subprocessor pages explain data handling and providers.
Read the privacy policy and subprocessor list for more detail.
Sorzio encrypts vault credentials with AES-256-GCM and binds the encryption to its context using authenticated additional data. Agent connections use OAuth 2.1 with PKCE S256 and scoped authorization.
After a batch reaches a terminal state, input content is automatically purged after 2 hours and output content after 7 days. Run metadata such as counts and costs is retained separately.
Hosted Lists expire after 2 hours on Free, 7 days on Pro, and persist on Scale until deleted. The purge_lists MCP tool lets you remove eligible lists without waiting for expiration.
An outbound SSRF egress firewall protects against requests to prohibited destinations. Workspace isolation and restrictive agent-token policies protect data access.