Data and privacy
One company per install
Section titled “One company per install”Each Sail install belongs to one company. There’s no shared database with other customers, no tenant column to get wrong, and no way for one company’s request to reach another’s data.
Everything Sail keeps lives in two places:
- The Postgres database: chats, memories, assistants, settings, the audit log, and the text of attached files.
- The file volume: uploaded and generated files, and their previews.
Self-hosted, both are on your servers, in your network, under your backup and encryption policies.
What leaves Sail
Section titled “What leaves Sail”| Goes to | What | Why |
|---|---|---|
| Your Msty Nexus | The prompt: the message, the conversation so far, the assistant’s instructions, the person’s memories, and the text of files in the chat | To get an answer from a model |
| The model providers your Nexus uses | The same prompt, passed on by Nexus | They write the answer |
| Nexus’s search provider | Web search queries | Only when an assistant searches the web |
| Your identity provider | Sign-in requests and hourly access checks | To sign people in, and sign them out when they leave |
That’s the full list. Sail sends nothing to Msty: no telemetry, no analytics, no content.
Which model providers see your prompts is decided in your Nexus, not in Sail. Point Nexus at models on your own hardware, and prompts never leave your network.
What Nexus learns about people
Section titled “What Nexus learns about people”Sail sends Nexus a random ID for each person, never a name or an email. Nexus uses it to report usage per person. Sail also sends the chat’s ID, so a conversation stays on one model server and caching works.
The memories in a prompt can include someone’s name, job title and department, as the assistant needs them to answer well.
Who can see what
Section titled “Who can see what”| Who | Can see | Can’t see |
|---|---|---|
| The person | Their own chats, memories, files and usage | Anyone else’s, unless shared with them |
| Colleagues | Only chats and files someone explicitly shared with them, as read-only copies | Anything not shared, and never the sharer’s memory |
| Owners and admins | People, teams, policies, company assistants, usage numbers, the audit log | Anyone’s chats or memories |
| Auditors | The audit log and usage numbers | Everything else |
| Assistant owners | Ratings and comments people chose to share, and usage counts | The chats themselves |
Sharing never reaches outside your company, and your admins can turn it off entirely.
Memory
Section titled “Memory”- Memories belong to the person. Only they can see, edit and delete them.
- Sail never remembers passwords, keys, card or account numbers, or health details.
- People can turn memory off for one chat or for everything, and undo any change for 30 days.
- Admins can turn memory off for everyone or for chosen teams.
How long data is kept
Section titled “How long data is kept”| Data | Kept | Set by |
|---|---|---|
| Chats | Forever, or a number of days after their last activity | Chat retention policy |
| Deleted chats and files | 30 days in the trash, then deleted for good | Fixed |
| Chats of people who left | 90 days after their account is disabled | Chats of people who left policy |
| “Ongoing work” memories | Fade after about four weeks without use | Fixed |
| Audit log | 365 days | Audit log policy, at least 30 days |
| Data exports | 7 days, then deleted | Fixed |
| Backups | As long as you keep them | You, with backup.sh --keep |
Export and erasure
Section titled “Export and erasure”People can download everything Sail keeps about them, any time, from Your data in the account menu: every chat, their memories, their own assistants, and their Folio files with every version. This works even if your organization turned off chat exports.
People can also ask for erasure. An admin approves or declines, and nobody can decide their own request. On approval, Sail:
- signs them out everywhere and closes their account;
- deletes their chats, including the trash, their memories, their personal assistants and their Folio files;
- clears their name and email.
Their account record stays, disabled and anonymous, so the audit log still makes sense. Erased data is deleted at once, not after the 30-day trash. Copies in your own backups go when those backups expire.