Data and privacy
Written for the person who has to answer "where does our data actually go?" — about a self-hosted install. On Cloud, the same data lives on our servers instead.
What is stored
| What | Where | Notes |
|---|---|---|
| Original files | backend_uploads volume | Exactly as uploaded. |
| Extracted text and passages | PostgreSQL | Including OCR output for scans. |
| Search vectors | PostgreSQL (pgvector) | Numeric representations of your text. |
| Conversations | PostgreSQL | Questions, answers and their citations. |
| Accounts | PostgreSQL | Name, email, role, hashed password. |
| Audit log | PostgreSQL | Administrative actions and who performed them. |
| Backups | backend_uploads, plus your offsite folder | Full database dumps. |
| Language models | ollama_data | Downloaded, not derived from your data. |
Nothing is written outside those three volumes, except backups you deliberately copy elsewhere.
What leaves the machine
Two things, neither of which carries document content:
- Licence verification — every 30 minutes to
api.chroniclerlm.com, carrying the licence key and an install identifier. - Downloads — images from Docker Hub, the compose file from GitHub, and models from the Ollama registry, when you install or update.
No telemetry, no usage analytics, no crash reports.
docker compose logs backend
shows the outbound calls, and a packet capture on the host will show nothing
else.Who can see what
- People see their own documents and collections, plus what's shared with them.
- Sharing is explicit — nothing is visible to the whole organisation by default.
- Administrators can manage accounts and restore backups. A restore rewrites the whole database, which effectively means administrators can read everything. Keep the number of administrators small.
- Every administrative action is recorded in the audit log.
Deleting data
| To delete | Do this |
|---|---|
| A document | Delete it in the app. File and passages both go. |
| A conversation | Delete it in the app. |
| A person's account | Admin → Users → Delete. Their documents go with it — suspend instead if you need to keep them. |
| Everything | docker compose down -v. Deletes both volumes and every backup inside them. |
Backups made before a deletion still contain the deleted data. If a deletion has to be complete, delete the backups covering it too — including the offsite copy.
Retention
Chronicler doesn't expire anything on its own. Documents and conversations stay until someone deletes them. The only automatic deletion is old backups, which are pruned to the count set in Admin → Backups.
Regulatory questions
A self-hosted install keeps document content on hardware you control, in a country you choose, which is usually the crux of a data-residency question. The licence check is the only routine outbound connection, and it carries no personal data.
If your assessment needs specifics — sub-processors, the exact fields sent during a licence check, retention commitments — ask your supplier rather than inferring it from this page.