> ## Documentation Index
> Fetch the complete documentation index at: https://docs.artu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Governance

> How Artu governs, stores, protects, returns, and retains your compliance data

Artu processes sensitive compliance data on your behalf. This page explains who owns that data, how it is governed and stored, and how you can retrieve your data at any time.

<Info>
  This page complements [Security & Trust](/concepts/security-trust), which
  covers our application-level security controls, and [Business Continuity &
  Disaster Recovery](/concepts/business-continuity), which covers operational
  resilience and recovery.
</Info>

## Data Ownership

You own your data. The compliance data you submit remains your property and under your control; Artu processes it only on your behalf and does not use it for its own purposes or sell it.

Under Mexican data-protection law (LFPDPPP), your organization is the data controller (*Responsable*) and Artu acts as the data processor (*Encargado*), processing personal data solely on your instructions. These roles and your data-ownership rights are set out in our [Terms and Conditions](https://dashboard.artu.ai/legal/terms) and in the Data Processing Agreement (DPA) that forms part of your Master Services Agreement (MSA). If your team needs additional documentation or a completed data-processing questionnaire, [contact us](mailto:support@artu.ai).

## Confidentiality

Customer data is protected in transit and at rest:

* **In transit:** all traffic is encrypted over HTTPS/TLS.
* **At rest:** data is encrypted by our managed cloud infrastructure.
* **Files** are stored in private storage and are never publicly accessible; they can only be reached through short-lived, signed URLs scoped to your organization.
* **Errors and logs** are sanitized before they leave the system. Credentials, tokens, internal file references, and common identity fields are redacted, and internal error details are never returned to API clients.
* **Monitoring** is configured to avoid collecting personal data by default.

## Data Governance and Access

Access to your data is governed by least-privilege controls enforced at multiple layers:

* **Tenant and environment isolation** is enforced at the database level using row-level security. Every record is partitioned by organization and environment, and your test and live environments are isolated from each other.
* **Least-privilege authorization** uses an `{environment}:{resource}:{operation}` permission model. API keys can be scoped narrowly (for example, read-only in test), and user access is managed through an enterprise identity provider.
* **Auditability** is provided by tamper-evident audit logs. Audit entries are hash-chained per organization and environment, and customers with the appropriate permissions can retrieve them and verify their integrity through the API.

<Info>
  See [API Keys](/concepts/api-keys) and [Environments](/concepts/environments)
  for how access is scoped.
</Info>

## Where Your Data Is Stored

Structured compliance data is stored in a managed PostgreSQL database. Uploaded files (documents, evidence, generated reports) are stored in private, object-storage buckets with per-bucket size and file-type restrictions. Storage paths are namespaced by organization and environment so that data cannot be accessed across tenants.

### Data residency

Customer data is hosted in the **United States** by default. The specific hosting region and infrastructure details are available on request under NDA.

If your regulatory or contractual requirements call for data to reside in a **different region**, [contact us](mailto:support@artu.ai) — we can discuss regional hosting options for your organization.

## Data Portability and Offboarding

Your data is available to you at any time, both while you use the platform and if you decide to leave.

* **Self-service export.** Every resource — clients, transactions, documents, evidence, reports, and audit logs — is retrievable through the API and the dashboard, and files and reports can be downloaded through signed URLs. You can export your data yourself at any time.
* **Full export on request.** Exporting large volumes resource by resource can be inefficient. If you would prefer a complete export of all your data at once, [contact us](mailto:support@artu.ai) at any time and we will provide it within a reasonable time frame.

**Export format.** Structured records are exported as JSON, matching the same schema you receive from the API and SDK, and your uploaded documents and generated reports are delivered in their original file formats (for example, PDF, JPEG, PNG, or XML). This keeps your data machine-readable and straightforward to load into another system.

This applies during offboarding as well: whether you stay or leave, you retain access to your data and can request a full copy.

### Data retention and deletion

Compliance data cannot always be deleted immediately when you leave. Mexican anti-money-laundering law (LFPIORPI) requires that records related to Vulnerable Activities be retained for **at least 10 years**. Artu retains this data for the legally mandated period so that you continue to meet your record-keeping obligations after offboarding.

Once the applicable retention period has elapsed, your data can be deleted. If you have specific deletion requirements or need written confirmation of deletion, [contact us](mailto:support@artu.ai).

## Questions

For security questionnaires, vendor reviews, data-processing agreements, or residency questions, contact [support@artu.ai](mailto:support@artu.ai).