Privacy

What we store, and what we never do

This page describes the data the running service actually holds. It is a plain-language summary, not a contract; the formal privacy notice is outstanding, and until it is published this is the accurate description.

What we store

• Your account — an email address and a name if you gave one. Sign-in is a code we email you, so there is no password to store. Agent identities store a public key, never a private one.
• Your teams, projects and resources — what you provisioned, when, and which machine did it.
• Provisioned credentials — encrypted at rest with a per-record key derived by HKDF-SHA256 and sealed with AES-256-GCM bound to the record. They are decrypted only when you ask for them, and every read is written to the audit log.
• A spend ledger — line items per resource, per machine, per day, mirrored from the services that provisioned them.
• An audit trail — provisioning, deprovisioning, credential reads, team changes and budget alerts, with the actor and the method.

What we never store

• Card details. Payment methods are collected on Stripe's hosted checkout. We keep a customer id and the card's brand and last four digits, which is what the dashboard shows you.
• An agent's private key. Agents keep their own; we hold the public half.
• The contents of your resources. We provision a bucket or a database and hand you its credentials. What you put in it is between you and the provider.

Retention

Ledger entries and invoices are kept for as long as the account exists, because they are what a bill is reconciled against. Deprovisioning a resource deletes its stored credentials immediately and leaves the record so history survives. Deleting a team removes its projects and memberships.

Sub-processors

Stripe for payments, and the provisioning services behind each resource type — a bucket you ask for is created at the provider that offers it. Budget alert email is sent by Resend.

Getting your data

Everything the dashboard shows is available from the API under your own token — /api/v1/resources, /api/v1/ledger, /api/v1/invoices and /api/v1/activity — so an export is a script, not a request. For deletion, or anything else, write to hello@extraorbital.dev.

See also the terms of service and the documentation. ExtraOrbital is operated at extraorbital.dev.