Data flow at a glance
- Sign-in: Ace ID handles identity. Eight receives the authentication response and maintains a server-managed session for protected routes.
- Workspace: agent drafts are described as browser-local and account-scoped. They are not guaranteed to sync across browsers or devices.
- Inference: submitted prompts and necessary context travel from the server to the configured model provider, such as Groq or OpenAI.
- Embedding: a published widget can send visitor messages to the configured service. Public widget instructions should be treated as public.
- Optional storage: Supabase/database features may process data only where configured and used. Actual schema, retention, region, and access controls should be verified against the deployment.
Data minimization
Submit only the information needed for the task. Avoid credentials, payment card details, health records, government identifiers, or other sensitive personal data in prompts unless the feature is specifically designed for it and appropriate safeguards are in place.
Model-provider handling
Model providers process prompt content to generate responses under their applicable service terms. The operator should maintain a provider inventory, verify retention and training settings, and disclose material changes before adding providers.
Retention and deletion
There is not yet a verified, published retention schedule for every data category. Browser-local drafts can be removed by clearing site data; this does not delete records that may be held by an AI provider or a configured database. Before public launch, the operator should document deletion paths, backup expiry, and a request process.
Operational checklist
- Keep secrets out of client bundles and public embed snippets.
- Enforce identity, permissions, quotas, and input validation on the server.
- Limit request logs and avoid recording raw prompts unless necessary.
- Review provider settings, database policies, and retention on each deployment.
- Test cookie preferences and ensure optional trackers do not run before consent.