# Where everything lives > Named per component: the models, the index, the documents, the logs, the telemetry, the backups. “Your account” below means wherever the engine runs: your AWS account, Azure subscription or Google Cloud project, your own servers under Docker, or, with [Atlantic-hosted](/clouds/atlantic-hosted/), a dedicated account in Atlantic’s AWS organisation that holds your data and no one else’s. ## At a glance | What | Where it lives | Who holds the key | | ---------------------------------------------- | ------------------------------------------------------------- | -------------------------------- | | Your source documents | Where they are today: your drive, wiki, repositories, buckets | You | | The index (chunks, embeddings, metadata) | Your account | You | | Prompts and answers | Your account, and only if you turn prompt retention on | You | | Agents’ outputs, approvals and decisions | Your account | You | | Connector credentials | Your account’s secret store | You | | Engine logs, and the log of every content read | Your account | You | | Operational telemetry | LightHouse, AWS, EU (Ireland) | Atlantic, encrypted at rest | | Evidence and value reports | LightHouse, sealed under your tenant’s own key | A key held for your tenant alone | | Exported content (only if you turn export on) | LightHouse, sealed under your tenant’s own key | A key held for your tenant alone | | LightHouse’s database backups | AWS, EU (Ireland) | Atlantic, encrypted at rest | ## The models The gateway calls models from your account. Which service runs them depends on the path you choose for each model: - **In your cloud**: Amazon Bedrock in your AWS account, Vertex AI in your Google Cloud project, or Azure OpenAI in your subscription. The call stays inside your cloud provider, under your contract with them. - **A provider’s API with your own key**: the Claude API, for example. The provider processes the call under your contract with them. - **Managed through Atlantic**: model access Atlantic provides and bills. The provider is then Atlantic’s sub-processor, listed on [Sub-processors](/trust/subprocessors/). Where each path runs inference is on [Regions](/data-sovereignty/regions/#the-inference-geography-of-each-model-path). ## The index Your connectors read your sources and write the index in your account: SQLite (with `sqlite-vec`), PostgreSQL (with `pgvector`) or OpenSearch, depending on your stack. Retrieval runs there too. LightHouse receives the index’s statistics, never its contents: how many documents and chunks, how fresh, how many failed to ingest, the embedding model’s name. See [Knowledge bases](/concepts/knowledge-bases/). ## The documents Your source documents stay where they are. A connector reads them with read-only scopes and writes what it indexes into your account. Nothing is uploaded to Atlantic. A document deleted at its source is removed from your index on the next pass. ## The logs | Log | Where | | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | The engine’s own logs (gateway, orchestrator, reader, handler) | Your cloud’s logging service, in your account | | Every content read: viewer, signing key, request ID, what and when | Your content reader’s log, in your account | | Your tenant’s audit log: sign-ins, refusals, changes, content reads, Atlantic staff reads | LightHouse. Append-only; yours to read in **Setup and admin → Audit** | | LightHouse’s own service logs | Atlantic’s account. A refusal logs its fixed code, never the value that was refused | ## The telemetry Telemetry is stored in LightHouse’s database: PostgreSQL on Amazon RDS in `eu-west-1`, encrypted at rest with a key managed in AWS KMS, deployed across availability zones, and not reachable from the internet. Every tenant’s rows are walled off by [row-level security](/security/api/#tenant-isolation-in-the-database). How long it is kept: | Record | Kept for | | ---------------------------------------------------------------------- | ------------------------------------ | | Telemetry records (model calls, runs, steps, evaluations and the rest) | 400 days by default, per record type | | Trace spans | 30 days by default | | Exported content, where export is on | 30 days by default | Your tenant’s record can set its own retention, longer or shorter, per record type. Ask through your certified forward-deployed engineer. ## The backups **Your account’s backups** are yours. The stack configures your index store and the gateway’s store in your account; their backups follow your cloud’s settings and your policies. **LightHouse’s database** keeps automated backups for 14 days, encrypted with the same managed key, in the same region. A final snapshot is kept if the database is ever deleted, and deletion protection is on. Report documents and exported content are sealed under your tenant’s own key before they are stored. Destroying that key, which offboarding schedules, makes them unrecoverable everywhere, backups included. See [Leaving](/data-sovereignty/leaving/). Source: https://docs.atlanticagenticlabs.com/data-sovereignty/where-everything-lives/