Customer data policy

Ownership and authority

Customers retain ownership of their content. A workspace owner must have authority to upload or connect each record and is responsible for assigning its permitted data class. Paxo does not treat a document, AI output, email domain, or provider login as business authorization.

Storage and originals

Customer workspaces covered by this policy use the United States data region. Uploaded files enter quarantine, receive a full-content malware and structural safety check, and are not available to users or downstream processors until that check succeeds. A clean original is preserved separately with immutable-write evidence. Previews, OCR, and extracted text remain traceable to the exact original version and hash.

Default retention

Retention follows the recorded workspace policy and any applicable signed order. Technical protection varies by provider and record: protected original versions prevent ordinary overwrite or deletion, while a fixed retention period or legal hold applies only when that control has actually been configured and evidenced. A zero-day technical retention setting is not a promise of immediate deletion. Eligible deletion remains subject to recorded holds, unresolved reconciliation, security incidents and other binding obligations.

Disconnecting an integration stops new synchronization but does not silently delete records already accepted into the workspace. Workspace export and deletion requests remain subject to the same retention and hold rules.

AI and document processing

Regulated records are accepted only under the Compliance package after signed agreements, including a BAA where applicable, and qualification of the dedicated Azure environment and approved data classes. Ordinary workspaces must not upload regulated records. Requesting or paying for the package alone does not authorize regulated-data processing.

Paxo sends only the authorized, bounded evidence required for the configured purpose. The workspace owner reviews one versioned Workspace Processing Terms step after the dashboard is ready; earlier account-service acceptance does not enable these processing purposes. Settings shows the reviewed providers, regions, purposes, limits and expiries, with renewal and revocation controls. AI may answer with citations or prepare a proposal; it cannot approve or execute a business command.

Paxo requests store:false for compatible OpenAI responses. That is not a guarantee of zero supplier retention. OpenAI API content is not used for model training by default unless the organization opts in; supplier retention and abuse monitoring follow its applicable terms and account settings. Paxo does not train shared models on customer content without a separate explicit agreement. Unconfigured processing, restricted content and operations outside the approved purpose remain unavailable.

Connected providers

A workspace owner chooses each provider and reviews the exact read operations before synchronization starts. Credentials are isolated from customer records. Disconnect and provider revocation stop new work; ambiguous financial or external effects enter reconciliation instead of being replayed blindly.

Access, export, and deletion

Tenant and role checks apply on every customer request and worker operation. Workspace owners can request a portable export and deletion of eligible records. Audit evidence may be retained when required to prove access, approval, security, reconciliation, or deletion, but it must not contain provider credentials or unnecessary document content.

Contact

Questions or customer-data requests can be sent to privacy@paxo.io. Material policy changes receive a new version and require fresh acceptance where applicable.