> ## Documentation Index > Fetch the complete documentation index at: https://docs.ironoctopus.ai/llms.txt > Use this file to discover all available pages before exploring further. # Security and privacy > Who owns your code, how your data and content are handled and protected, who it's shared with, how long it's kept, and how access is controlled. You own your code and everything Iron Octopus builds for you. Iron Octopus uses your content only to do the work you ask for, never to train AI, and protects it in transit and at rest. This page summarizes how. The [Privacy Policy](https://www.ironoctopus.ai/privacy) and [Terms of Service](https://www.ironoctopus.ai/terms) are the full, binding versions. If anything here differs from them, they apply. ## Your code and content * **You own it.** Your ideas, requirements, conversations and data, and the code, tests, plans and other work Iron Octopus produces for you, belong to you. * **It's used only to provide the service to you.** Iron Octopus doesn't read your content to improve the product unless you ask it to help with a specific problem. * **You can take it with you.** You can [export your code](https://docs.ironoctopus.ai/build/feature-history.md#export-the-code) at any time. See [where your code lives](https://docs.ironoctopus.ai/code/where-your-code-lives.md). ## AI and your content * **No training.** Your content isn't used to train or fine-tune any AI model. Iron Octopus uses AI providers under terms that don't let them train on it either. * **Only what's needed.** Iron Octopus sends the parts of your content a task needs to the AI provider, through the provider's business API. * **Limited retention by providers.** Providers may keep requests briefly to detect abuse, as their business terms allow, then delete them. * **Your own provider.** If you [connect your own AI subscription](https://docs.ironoctopus.ai/ai/your-own-provider.md), content sent through it goes to that provider under your agreement with them. ## Who your data is shared with Only the service providers that run Iron Octopus, and only what each one needs: | Provider | For | | - | - | | Google Cloud | Hosting, databases and storage, in the United States | | Clerk | Sign-in and account management | | Stripe | Payments and billing | | GitHub | Hosting the repositories Iron Octopus manages for your projects | | OpenAI and Anthropic | The AI that generates plans, code, tests and reviews | Each is bound by contract to protect your data and use it only to provide its service. The list is updated before a new provider that handles customer content is added. Iron Octopus doesn't sell personal information or use it for advertising. ## How it's protected * **Encryption.** All data is encrypted in transit. Stored data is encrypted at rest, and credentials for connections such as GitHub and AI providers are encrypted separately. * **Payment details.** Card details go to Stripe. Iron Octopus never sees or stores your full card number. * **Limited access.** Access to production systems is limited to the people who need it. * **Breaches.** If a breach affects your personal information, you'll be told without undue delay and as the law requires. ## Access in your workspace * **Roles.** Every member is a Guest, Member, Admin or Owner, and each action checks the role. See [roles](https://docs.ironoctopus.ai/building-blocks/workspaces.md#roles). * **Sign-in.** Each person has their own account. Accounts can't be shared. Workspace SSO (SAML or OIDC) is available through [support](https://docs.ironoctopus.ai/account/support.md). * **A record of everything.** Every plan, approval, review, release and rule change is recorded with who made it and when. Rule changes also record why. See [feature history](https://docs.ironoctopus.ai/build/feature-history.md). * **Rules can't be bypassed silently.** Changing a rule needs an Admin, a reason, and a published version. See [change a rule](https://docs.ironoctopus.ai/rules/change-a-rule.md). ## How long it's kept | Data | Kept | | - | - | | Account information and your content | For as long as your account is open | | After you close your account | 30 days to export your code and content. It's then deleted within a further 30 days, and from backups within 90 days. | | Billing records | As long as tax and accounting law requires, usually up to 7 years | | Logs | Up to 90 days, unless needed longer to investigate a security issue | ## Where it's stored Iron Octopus is hosted in the United States. For transfers from the EU, UK or Switzerland, Iron Octopus relies on the European Commission's Standard Contractual Clauses, with the UK addendum, or another lawful transfer method. A data processing agreement is available on request. ## Cookies Iron Octopus uses only the cookies needed to sign you in, protect against fraud and take payment. There are no analytics, advertising or tracking cookies, so there's no cookie banner. ## Your rights and contacts You can ask to see, correct, export or delete your personal information, or object to how it's used. Requests are answered within 30 days. | For | Contact | | - | - | | Privacy requests, or a data processing agreement | [privacy@ironoctopus.ai](mailto:privacy@ironoctopus.ai) | | A suspected security issue or compromised account | [security@ironoctopus.ai](mailto:security@ironoctopus.ai) | | Legal questions | [legal@ironoctopus.ai](mailto:legal@ironoctopus.ai) | Iron Octopus Inc., 849 W 18th St, Ste C, Costa Mesa, CA 92627. ## Legal documents * [Privacy Policy](https://www.ironoctopus.ai/privacy): what personal information is collected, why, who it's shared with, and your choices. * [Terms of Service](https://www.ironoctopus.ai/terms): the agreement for using Iron Octopus, including ownership, billing and acceptable use. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.