Skip to main content
Before you send your users’ data through Cadenya, you want to know where it goes, who owns it, and who can read it. Each answer here names its source: the privacy policy, the subscription agreement, or the API spec.

​
Where is data processed?

In the United States, apart from model calls. Cadenya operates there, and your data may be stored and processed there (privacy policy, section 8). Model calls go to the AI provider you configure, because Cadenya does not provide inference. You can bring a key for OpenAI, Anthropic, Gemini, OpenRouter, Amazon Bedrock (in the region you choose), or Google Vertex AI (in the project and location you choose). Or point Cadenya at any OpenAI-compatible endpoint, including one you host (the AIProviderKeySpec schema in the API spec).

​
Who owns the data?

You do. You keep every right to your data and to the outputs your Agents produce (subscription agreement, sections 8 and 10). Cadenya doesn’t train its AI models on your data. And it doesn’t sell, rent, or trade your data or personal data to third parties for their own marketing or commercial purposes (privacy policy, section 4).

​
How long does Cadenya keep it?

Sources: privacy policy, section 6; subscription agreement, section 8; the episodicMemoryTtl field in the API spec. When a subscription ends, you have 30 days to retrieve your data. Then Cadenya deletes it (subscription agreement, section 13).

​
How are secrets and credentials protected?

Cadenya encrypts data at rest with AES-256 and in transit with TLS 1.2 or later (privacy policy, section 7). Secrets get more than that:
  1. Each secret value uses its own data key (envelope encryption), so storage never receives the plaintext.
  2. Cadenya decrypts a secret only at the point of use, and records each use in last_used_at.
  3. AI provider credentials never come back in an API response.
Sources: the Tool Sets guide and the AIProviderKeySpec schema in the API spec.

​
Where can my Tool Sets send requests?

Only to hosts your account trusts. Cadenya checks every Tool Set request against your trusted endpoints, including syncs, previews, tool calls, and redirects. So a Tool Set can’t send your credentials to a host you never chose.

​
Do I have to open my internal APIs to Cadenya?

No. With client tools and Bare tools, Cadenya hands each tool call to your application. Your application runs it inside your network and sends back the result.

​
Can I delete one customer’s data?

Yes. Pass a tenant, and a subject if you have one, when you create an objective. Cadenya can then purge the data for that tenant (objectives guide).

​
What security work is in place?

The privacy policy (section 7) and the subscription agreement (section 8) list these measures:
  1. Cadenya encrypts data at rest with AES-256, and in transit with TLS 1.2 or later.
  2. Cadenya staff work under role-based access controls and sign in with multi-factor authentication.
  3. Cadenya keeps your API credentials in isolated, encrypted storage.
  4. Cadenya runs regular penetration tests and vulnerability assessments.
  5. Cadenya logs and monitors security events, and it follows incident response procedures.
If a breach materially affects your data, Cadenya tells you within 72 hours of confirming it (privacy policy, section 7). To report a security issue or send a privacy request, use the contacts in the privacy policy.