> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outerlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> Where each security and privacy fact lives, how long OuterLayer keeps data, and how to report a vulnerability.

This page points to the page that answers each security or privacy question. It also says how long OuterLayer keeps data and how to report a vulnerability.

## Find a security or privacy fact

| Question | Where to read |
| - | - |
| What does the CLI send to OuterLayer, and when? | [What leaves your machine](https://docs.outerlayer.ai/what-leaves-your-machine.md) |
| What is removed before a session uploads? | [What is scrubbed before upload](https://docs.outerlayer.ai/what-leaves-your-machine.md#what-is-scrubbed-before-upload) |
| How do I keep one repository's sessions off the server? | [Keep a repository off the server](https://docs.outerlayer.ai/what-leaves-your-machine.md#keep-a-repository-off-the-server) |
| What does a build host send? | [A build host](https://docs.outerlayer.ai/what-leaves-your-machine.md#a-build-host) |
| What does the dashboard send from my browser? | [Dashboard analytics and error reports](https://docs.outerlayer.ai/usage-analytics.md) |
| What can OuterLayer staff see and change in my organization? | [Platform admin access](https://docs.outerlayer.ai/platform-admin-access.md) |
| What can a build reach, and what does isolation not cover? | [Build isolation and limits](https://docs.outerlayer.ai/build-security.md) |
| What can the GitHub App do, and what tokens does a build get? | [GitHub App permissions and build tokens](https://docs.outerlayer.ai/github-app-and-build-tokens.md) |

## How long data is kept

OuterLayer deletes agent session records automatically after your plan's retention period. The period is 90 days on Team and the period in your order form on Enterprise. [Plans and limits](https://docs.outerlayer.ai/billing-and-trials.md#plans-and-limits) shows the same periods.

OuterLayer keeps other organization and account data while your account is open. After an account closes, OuterLayer deletes it as the [Data Processing Addendum](https://outerlayer.ai/dpa) describes.

OuterLayer keeps billing records as long as tax and accounting law requires. It keeps usage data, error reports and logs only as long as they help run, secure and fix the service.

## Contracts and vendors

The [Privacy Policy](https://outerlayer.ai/privacy) says what personal data OuterLayer collects and why. The [Data Processing Addendum](https://outerlayer.ai/dpa) governs the customer data your organization submits and lists the security measures. The [subprocessors page](https://outerlayer.ai/subprocessors) lists the vendors that host and run OuterLayer.

To see, correct, export or delete your data, email [hello@outerlayer.ai](mailto:hello@outerlayer.ai).

## Report a vulnerability

Email [security@outerlayer.ai](mailto:security@outerlayer.ai). Do not open a public issue for a vulnerability. To encrypt your report, say so in your first message, and OuterLayer sends a key.

Include as much of this as you can:

* What an attacker can do, and what they need to do it.
* The affected part, such as the dashboard, the gateway or the CLI, and its version.
* The smallest steps that reproduce the problem.
* Whether you tested your own deployment, the hosted service or the source.

OuterLayer acknowledges your report within 3 business days. It gives an initial assessment within 10 business days. The assessment states the severity and whether OuterLayer can reproduce the problem.

Test against your own local or self-hosted deployment when you can. To test the hosted service, use your own account and your own data, and email first. Do not access another customer's data, run volume tests or try social engineering.

If you reach another organization's data by accident, stop and tell OuterLayer what you saw. Do not keep it.

OuterLayer has no paid bounty program today.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.