Where everything lives
“Your account” below means wherever the engine runs: your AWS account, Azure subscription or Google Cloud project, your own servers under Docker, or, with Atlantic-hosted, a dedicated account in Atlantic’s AWS organisation that holds your data and no one else’s.
At a glance
Section titled “At a glance”| What | Where it lives | Who holds the key |
|---|---|---|
| Your source documents | Where they are today: your drive, wiki, repositories, buckets | You |
| The index (chunks, embeddings, metadata) | Your account | You |
| Prompts and answers | Your account, and only if you turn prompt retention on | You |
| Agents’ outputs, approvals and decisions | Your account | You |
| Connector credentials | Your account’s secret store | You |
| Engine logs, and the log of every content read | Your account | You |
| Operational telemetry | LightHouse, AWS, EU (Ireland) | Atlantic, encrypted at rest |
| Evidence and value reports | LightHouse, sealed under your tenant’s own key | A key held for your tenant alone |
| Exported content (only if you turn export on) | LightHouse, sealed under your tenant’s own key | A key held for your tenant alone |
| LightHouse’s database backups | AWS, EU (Ireland) | Atlantic, encrypted at rest |
The models
Section titled “The models”The gateway calls models from your account. Which service runs them depends on the path you choose for each model:
- In your cloud: Amazon Bedrock in your AWS account, Vertex AI in your Google Cloud project, or Azure OpenAI in your subscription. The call stays inside your cloud provider, under your contract with them.
- A provider’s API with your own key: the Claude API, for example. The provider processes the call under your contract with them.
- Managed through Atlantic: model access Atlantic provides and bills. The provider is then Atlantic’s sub-processor, listed on Sub-processors.
Where each path runs inference is on Regions.
The index
Section titled “The index”Your connectors read your sources and write the index in your account: SQLite (with sqlite-vec), PostgreSQL (with pgvector) or OpenSearch, depending on your stack. Retrieval runs there too.
LightHouse receives the index’s statistics, never its contents: how many documents and chunks, how fresh, how many failed to ingest, the embedding model’s name. See Knowledge bases.
The documents
Section titled “The documents”Your source documents stay where they are. A connector reads them with read-only scopes and writes what it indexes into your account. Nothing is uploaded to Atlantic. A document deleted at its source is removed from your index on the next pass.
The logs
Section titled “The logs”| Log | Where |
|---|---|
| The engine’s own logs (gateway, orchestrator, reader, handler) | Your cloud’s logging service, in your account |
| Every content read: viewer, signing key, request ID, what and when | Your content reader’s log, in your account |
| Your tenant’s audit log: sign-ins, refusals, changes, content reads, Atlantic staff reads | LightHouse. Append-only; yours to read in Setup and admin → Audit |
| LightHouse’s own service logs | Atlantic’s account. A refusal logs its fixed code, never the value that was refused |
The telemetry
Section titled “The telemetry”Telemetry is stored in LightHouse’s database: PostgreSQL on Amazon RDS in eu-west-1, encrypted at rest with a key managed in AWS KMS, deployed across availability zones, and not reachable from the internet. Every tenant’s rows are walled off by row-level security.
How long it is kept:
| Record | Kept for |
|---|---|
| Telemetry records (model calls, runs, steps, evaluations and the rest) | 400 days by default, per record type |
| Trace spans | 30 days by default |
| Exported content, where export is on | 30 days by default |
Your tenant’s record can set its own retention, longer or shorter, per record type. Ask through your certified forward-deployed engineer.
The backups
Section titled “The backups”Your account’s backups are yours. The stack configures your index store and the gateway’s store in your account; their backups follow your cloud’s settings and your policies.
LightHouse’s database keeps automated backups for 14 days, encrypted with the same managed key, in the same region. A final snapshot is kept if the database is ever deleted, and deletion protection is on.
Report documents and exported content are sealed under your tenant’s own key before they are stored. Destroying that key, which offboarding schedules, makes them unrecoverable everywhere, backups included. See Leaving.