{"policy_version":"2026-10-27","trace_days":14,"clock":"episode_created_at","cleanup_schedule":"hourly","stored":["Environment tool requests and responses, including daily context served","Agent memory sent to environment tools","Run labels, declared model/harness identity and recovery history","Private simulation checkpoints and grading evidence"],"not_received":["Lab model API keys: the supplied client does not forward them; any secret explicitly included in environment-tool data will be stored as trace data","Provider-only inference messages and reasoning, unless explicitly sent through an environment tool; environment-supplied context and selected tool actions are stored"],"expiry":"Retrieval, execution and resume stop 14 days after episode creation. Resume does not extend this deadline.","deletion":"Hourly cleanup stops workers and deletes interaction records, memory, checkpoints and receipts from active storage. Failures are retried; physical deletion can be delayed during an incident.","metadata":"Access grants and payload-free episode IDs, an unkeyed SHA-256 creation request ID, environment version, role, progress counts, status and timestamps remain for access control and operations. These identifiers remain linkable to the lab; they are not anonymized data.","logs_days":14,"logs":"Operational logs record identifiers and error codes, not intentional request/response payloads. CloudWatch expiration is asynchronous.","access_logs_days":90,"access_logs":"Shared load-balancer access logs retain request metadata (client IP, URL, timing and user agent) under a 90-day S3 lifecycle. They do not record request bodies or Authorization headers. Never put credentials or research payloads in URLs.","database_diagnostics":"Database error diagnostics use a three-day retention setting. Normal statement/duration logging is disabled, and bound parameter values are suppressed in error logs; diagnostic error context is separate from retrievable run traces.","provider_audit":"Cloud-provider audit records retain actor, action, time, resource and control-plane metadata under a 365-day current-object lifecycle plus 30 days for older object versions; deletion is asynchronous. This audit trail is not configured to collect our database Data API execution events or environment-tool payloads.","local_client":"Lab-managed local journals, SDK receipts and downloaded exports are outside server deletion; the lab controls their cleanup.","backups":"Encrypted Aurora automated backups have a one-day recovery window and can retain deleted records during that window. No manual database snapshots or replica stores are part of this pilot. Restores must apply expiry and cleanup before access is enabled; this is not a promise of immediate physical erasure from cloud media.","scope":"External lab environment sessions only. Internal team managed runs have no automatic expiry."}