Privacy notice for the pilotWritten from what the product does.
This notice describes the proposed first guided pilot, the records it creates, and the separate handling of support and pilot inquiries. The first pilot is limited to the ChatGPT text path below and a separately verified Anthropic gateway path. It does not by itself prove current release readiness. A draft pilot agreement with processing terms has been prepared for counsel review. It has not been reviewed by counsel, agreed or signed, and it must be reviewed and agreed before any enrollment. Contact records follow the retention schedule and gaps stated below.
The two paths in the proposed first pilot
Each path needs its own verification before it is included in your pilot. Configuring another product path does not bring it into this scope.
Typed or pasted text in the ChatGPT composer
The browser path is limited to typed or pasted text in the standard signed-in ChatGPT composer, in an enrolled browser profile on managed Windows 11 with Chrome. Managed installation and composer interception still require verification on a managed endpoint before enrollment. The extension decides locally and posts a content-free signed event; it does not proxy what the page sends.
An explicitly routed Anthropic gateway application
An application explicitly configured to route through the Anthropic hosted gateway is a separate path and requires independent verification. Its requests and responses are inspected before forwarding only when they use that route. Direct provider traffic remains outside it. The dated gateway proof does not establish current release readiness or browser coverage.
Outside the first pilot: the Windows sensor and other endpoint components; files, images, voice, alternative ChatGPT modes and browser responses; Edge, BYOD and other apps. Cloud drive inspection, outbound-mail inspection, MCP tool-call inspection and other gateway providers are also outside this first pilot scope.
Support and pilot requests create separate records
These records are separate from product inspection data. Read the handling gaps before requesting a pilot or sending a support message.
Email inquiries
Email to support@redactwall.com sends your address, message and any attachments to Microsoft 365 for support and pilot inquiries. Only the owner, Eric, has access to that mailbox: its access list was verified on 2026-09-25, with no delegates, send-as grants or forwarding.
For an initial email, use your work email address and ask about the status of the pilot terms. Keep organization and workflow details, customer records, credentials, prompt contents and attachments out of the initial message.
Identity verification and request records
When identity-based requests are enabled, Auth0 handles verification and keeps authentication logs. RedactWall records your verified email, identity-provider and account references, a request identifier and timestamps. Authorized RedactWall employees review the contact and request; approval and setup status are recorded separately. Verification does not grant pilot access.
Contact retention schedule and its gaps
Contact records follow a retention schedule adopted on 2026-09-25, not yet reviewed by counsel. Support and pilot-inquiry email is deleted 24 months after receipt, enforced by an Exchange Online retention policy applied on 2026-09-25; the oldest message was received on 2026-08-24, so none reaches that age before 2028-08. A deleted message is then purged after Exchange's recoverable-items window. Auth0 keeps its own authentication logs for 1 to 30 days by plan; the plan on this tenant was not read back. Our streamed copy of those logs is deleted after 365 days by an enforced retention setting. Auth0 identities with no workspace and no sign-in for 24 months are removed at a quarterly review. Pilot request, requester, contact and approval records in the platform database have no deletion today: the database refuses to delete them because they anchor the identity audit chain, so they are kept for the life of the service. A backup set expires about 9 weeks after it is superseded, but new backups keep capturing the retained database records. Requests about your own data are answered within 30 days. The employee activity and training retention periods do not cover these records. Ask about the status of the pilot terms before sharing more information.
What is stored, kept apart
Decision metadata and separately retained encrypted employee activity are different stores with different controls.
The audit record
The audit record stores decision metadata, including the kinds of finding and the action taken, rather than prompt bodies.
The employee activity store
Employee activity can retain encrypted content under separate access and retention controls. Content access is role controlled and reads are audited. These are two different stores, and this page does not blur them into one answer.
Evidence you send to your own systems
Evidence delivered to a SIEM, a ticketing system, a chat channel or a mail digest carries decision records, not content.
Raw content excluded from evidence and holds
Durable custody of raw content is not implemented for evidence or holds. For durable evidence, the commercial disclosure schema fixes raw content retention at 0 days, and the two evidence capabilities that would need it stay refused pending a threat model, an encryption design and a retention policy that nobody has approved. This evidence limit does not govern the separate employee activity store described above.
Where raw content does not go
The answer a security reviewer is actually asking for, stated once.
Content sent to the inspection service is processed in memory for the length of the decision. Raw content is not written to hosted logs, traces or error bodies: content-bearing fields use non-loggable types, and errors are sanitized before they leave the process. Automated privacy gates in the product repository fail its build when a hosted binary reaches a path that would break that boundary.
Changes to entries are detectable and a signed checkpoint exposes removal of the entries it covered. Check the record yourself.
How long it is kept
- Decision metadata in the audit record is kept for the audit period stated in your agreement.
- A separate employee activity store can retain encrypted content after mandatory hard-stop values are removed. Content access is role controlled and reads are audited. Operational retention defaults to 30 days, with a maximum of 90 days.
- Samples eligible for training remain subject to their ordinary retention period of 365 days.
Return and destruction at the end of a pilot is a drafted contractual obligation, not a product feature. There is no mechanism today that issues a destruction certificate, and this page does not claim one. Destruction at the end of a pilot cannot be certified today, and pilot request, requester, contact and approval records are kept for the life of the service.
Training and learning
The training policy requires explicit opt-in before future customer data is collected for training. Legacy samples are excluded from training until their rights are reviewed; they remain subject to their ordinary retention period of 365 days.
The opt-in policy is merged to the product main branch and shipped in release 0.1.12, which was installed on production on 2026-09-24. The live collection path has not been independently exercised, so this page does not claim that collection is already disabled in the live service. Do not use customer data until applicable terms have been reviewed and agreed.
Where to look next
The services that process anything on our side are listed on subprocessors. A draft pilot agreement with processing terms has been prepared for counsel review. It has not been reviewed by counsel, agreed or signed, and it must be reviewed and agreed before any enrollment. The data processing addendum is an unreviewed internal draft. See their status under documents for procurement. Material coverage limits are indexed in the disclosures.
This notice is restated on every change to what the product inspects, stores or retains, and reviewed annually regardless. Last reviewed 2026-09-25.
Read the limits before you decide.
Work with RedactWall to confirm fit, agree the scope and verify one managed device before expanding.
- Decision metadata and employee activity are separate stores
- Raw content stays out of hosted logs, traces and error bodies
- Raw content in durable evidence and holds is not implemented