XRAY Bridge avoids warehousing full-hour call transcripts and inbox mirrors. Under our Derive-and-Discard model, raw buffers have a TTL of zero, and we retain only task-anchored status changes and their brief supporting quotes, with One-Tap Clear and 72-hour human correction. This reduces what we hold. It does not take the data we do hold outside your legal or IT review.
When Zoom, Google Meet, Fathom, or Fireflies send a meeting transcript, or you paste one, XRAY Bridge processes it in memory. By default, rawBufferTtlDays = 0: the full transcript, including the off-topic majority of the call, is discarded right after extraction. Bridge does not accept or store audio or video.
For each fact, Bridge keeps the status change it supports and a 1-2 sentence verbatim quote with the speaker's name, up to 280 characters, with detected emails and secrets redacted. We keep the speaker's actual words because a paraphrase can turn "I think it went out" into "it went out." Action items and promises found in a meeting stay on that meeting's record. These excerpts are your customer data: they are stored in your workspace and remain subject to your own legal, compliance, and IT requirements.
Closing a task with One-Tap Clear removes its statement and quote together from the fact, the task, stored briefs, and our stored copy of brief emails, unless another open task still relies on that fact. Undo restores them for 72 hours, after which the backup copy is purged. A correction applied within its 72-hour window removes the original statement and quote the same way. Emails already delivered cannot be recalled, and deleted data stays in database backups until those backups age out.
All tenant records are stored in a Neon PostgreSQL 17 database dedicated to XRAY Bridge. Every application query runs through a non-superuser database role (bridge_app_rls) explicitly flagged with NOBYPASSRLS. The database enforces row-level policies across all 58 tables using session variable app.current_org_id set locally inside each transaction. This means an application bug that forgets a tenant filter is still limited to the current tenant's rows by the database.
OAuth tokens, provider webhook secrets, and customer BYOK API keys are encrypted at rest using envelope encryption (prefixed with hkdf_v1:). Each tenant's 256-bit encryption subkey is derived using HKDF-SHA256 bound to their unique organizationId. Keys are never stored alongside the database records and support zero-downtime key version rotation.
Automated cron workers run regular maintenance sweeps to purge stale transient data. Unmatched facts that exceed their validity window, transient transcript buffer scraps, expired guest voting tokens, and resolved correction requests are permanently hard-deleted from Postgres.
Our Neon production database runs in AWS us-east-1 (Northern Virginia) and uses Neon's Point-in-Time Recovery (PITR) for restores within its restore window. Backups can contain data you have since cleared or deleted until they age out of that window.
Every record class in XRAY Bridge follows an explicit Active Window → Archive / Supersede State → Hard-Delete Time-to-Live (TTL) schedule enforced by our daily maintenance worker alongside self-serve user controls.
| Data Class | Active Retention | Archive / Supersede | Hard-Delete (TTL) | Self-Serve Control |
|---|---|---|---|---|
| Raw Meeting Transcripts & Audio Buffers | In-memory only during extraction (~seconds) | Never archived at rest | 0 days (`rawBufferTtlDays = 0` immediate discard) | Configurable per workspace (`rawBufferTtlDays`) |
| Daily Briefs, Digests & Team Rollups | 30 days in Active Recent Briefs | Days 31–90 in Archived Briefs | 90 days (automated daily cron purge) | 1-click Archive / Unarchive or Permanent Delete anytime |
| Inline Fact Corrections & Evidence Backups | 72 hours active correction & undo window | Promoted corrections become standing Company Memory facts | 72 hours (unapproved corrections & cleared quote backups purged) | Approve, Reject, Save to Memory, or One-Tap Clear |
| Unmatched Derived Facts (`Fact` / `FactQuote`) | 30d (Blockers) · 60d (Commitments/Outcomes) · 90d (Decisions) | Marked `EXPIRED` or `SUPERSEDED` when replaced | Purged on TTL sweep after expiration window | 1-click Dispute / Edit Context or One-Tap Clear |
| Task-Matched Proof, Decisions & Fleet Seams | Active workspace lifetime | Archived when Decision/Task is archived | Retained until explicit item or workspace deletion | Self-serve JSON export & 1-click Delete / Retract |
| Agent Scope Claims (`FleetLease`) & Guest Tokens | 30m–4h (FleetLease) · 7d (DecisionGuestToken) | Released / Consumed audit state | Auto-expired by TTL timestamp | `brg release --all` or revoke in Automations & Agents |
All production workloads execute in the United States. Railway application servers run in us-east4 (Virginia) and Neon PostgreSQL databases run in AWS us-east-1 (Virginia). No customer payloads leave US borders.
Workspace Owners retain full sovereignty over their data. You can download a complete JSON export of your workspace at any time via GET /api/v1/organizations/export or permanently delete your workspace via DELETE /api/v1/organizations.