Autm
Data Retention Policy
Last Updated: 15th September 2026
Autm Limited (“Autm”, “we”, “us” or “our”) is committed to retaining personal data only for as long as it is necessary for the purposes for which it is processed, to provide and secure our services, to meet contractual requirements and to comply with applicable legal and regulatory obligations.
This Data Retention Policy explains how information processed through the Autm operational intelligence platform is retained, reviewed and securely deleted.
It should be read alongside our Privacy Policy, Terms of Service and, where applicable, the Data Processing Agreement between Autm and a customer organisation.
Autm applies the principles of data minimisation, storage limitation, purpose limitation, security and privacy by design to its retention practices.
1. Scope
This policy applies to personal data and customer data processed:
through the Autm platform;
in connection with user accounts and authentication;
within customer workspaces;
through connected third-party systems;
through AI-assisted functionality;
within organisational memory and operational intelligence;
through workflows and agent actions;
within operational logging, monitoring and security systems; and
by service providers and sub-processors acting on Autm’s behalf.
The information retained and the applicable retention period depend on the nature of the information, how the platform is used, contractual requirements and applicable law.
2. Our Role Under Data Protection Law
Autm may act as either a Data Controller or a Data Processor, depending on the circumstances.
When Autm is a Data Controller
Autm acts as a Data Controller where we determine why and how personal data is processed, including in relation to:
account creation and administration;
subscription and billing administration;
website enquiries and communications;
customer support;
platform security, fraud prevention and monitoring;
service performance and improvement;
legal and regulatory compliance; and
communications about Autm where permitted by law.
When Autm is a Data Processor
Where an organisation uses Autm to process information within its workspace, Autm generally acts as a Data Processor on behalf of that customer.
This may include information processed through:
email and calendar systems;
meetings and transcripts;
documents and files;
tasks and project-management systems;
CRM and other business applications;
workflows and agent actions;
organisational memory and operational context;
connected third-party systems; and
AI-assisted interactions carried out on the customer’s behalf.
In these circumstances, the customer organisation remains the Data Controller and determines the purposes for which personal data is processed.
Where Autm acts as a Data Processor, retention and deletion may also be governed by the customer’s documented instructions and applicable contractual arrangements.
3. Data Protection Contact
Questions about data retention, deletion or the exercise of data protection rights can be directed to:
Autm Limited
Little Wood House
Linley
Bishop’s Castle
Shropshire
SY9 5HP
United Kingdom
Email: support@autm.ai
4. Retention Principles
Autm applies the following principles when determining how long information should be retained:
Data minimisation
We seek to process and retain only information that is necessary for the relevant purpose.
Storage limitation
Personal data should not be retained for longer than is reasonably necessary for the purpose for which it is processed.
Purpose limitation
Information is retained and used only for legitimate and authorised purposes.
Customer control
Where Autm acts as a Data Processor, customer organisations retain control over their Customer Data, subject to the functionality of the platform, applicable contractual arrangements and legal requirements.
Security
Information retained by Autm is protected using appropriate technical and organisational security measures.
Deletion
When information is no longer required, it is deleted or otherwise rendered inaccessible in accordance with our deletion procedures and applicable legal requirements.
5. Data Hosting and Residency
Autm’s primary customer data infrastructure and data residency are hosted within Microsoft Azure in the United Kingdom.
Autm uses appropriate technical and organisational measures to protect data stored within its infrastructure, including encryption, access controls and secure cryptographic key management.
Some service providers, including AI model providers, may process limited information outside the United Kingdom or European Economic Area where necessary to provide their services.
Where personal data is subject to an international transfer, Autm uses appropriate safeguards as required by applicable data protection law.
Depending on the circumstances, these may include:
UK adequacy regulations or recognised adequacy arrangements;
Standard Contractual Clauses;
the UK International Data Transfer Addendum or other approved transfer mechanisms; and
additional technical safeguards such as encryption, data minimisation, redaction, tokenisation or pseudonymisation.
6. Retention by Data Category
6.1 User Account and Authentication Data
Autm accounts are managed using ASP.NET Core Identity.
Users may authenticate using:
an email address and password;
Google as an external identity provider; or
Microsoft (Entra ID) as an external identity provider.
Users may also link Google or Microsoft authentication to an existing Autm account. Depending on the authentication methods configured for an account, an account may support password authentication, external OAuth authentication, or both.
Authentication and account data may include:
name and email address;
account identifiers;
role and workspace membership;
password hashes, where password authentication is used;
external login identifiers linking an Autm account to Google or Microsoft;
session and authentication records;
login and security information; and
multi-factor authentication information, where enabled.
Passwords are not stored in plaintext. Where password authentication is used, passwords are stored and verified using one-way cryptographic hashes.
When Google or Microsoft is used to sign up for or sign in to Autm, Autm requests only identity scopes required for authentication, such as openid, profile and email.
This authentication process is separate from the OAuth process used to connect business services to Autm and does not itself authorise access to email, calendars, files or other information held within the user's Google or Microsoft account.
Depending on the account configuration and features enabled, Autm may support additional authentication controls including authenticator applications using TOTP, passkeys using WebAuthn/FIDO2, recovery codes and two-factor authentication.
Autm also maintains server-tracked session information for authenticated users. Sessions may expire or be revoked following inactivity, maximum session duration, sign-out or relevant security events.
Retention:
User account information and authentication records required to operate the account are generally retained for the duration of the active account.
Following confirmed account closure, relevant account data is scheduled for deletion and is permanently deleted within 30 days, unless continued retention is required for legal, security, fraud-prevention, financial or other legitimate purposes.
Session information is retained only for as long as required to manage authenticated sessions, security and associated audit requirements.
6.2 OAuth and Integration Credentials
Autm uses OAuth separately to enable authorised users to connect supported third-party business systems, including Microsoft and Google.
Depending on the integration, Autm may process:
OAuth authorisations;
access tokens;
refresh tokens;
integration identifiers;
granted permissions or scopes; and
information required to maintain the authorised connection.
Autm does not require users to provide their Microsoft, Google or other third-party account passwords in order to establish an OAuth connection.
OAuth credentials and tokens associated with connected services are protected using appropriate encryption, credential management and access controls.
Retention:
Integration credentials are retained while required to maintain the authorised connection.
Where an integration is revoked, disconnected or the relevant workspace is deleted, associated credentials are revoked or deleted in accordance with the applicable integration and Autm’s deletion procedures, subject to any limited technical or security retention requirements.
6.3 Customer Workspace and Operational Data
This may include:
workspace configurations;
workflows;
task and action records;
integration metadata;
documents and associated information;
meeting and transcript information;
CRM information;
operational context;
organisational knowledge;
actions and commitments; and
information derived from authorised connected systems.
Retention:
Customer workspace data is generally maintained for the active lifecycle of the workspace and in accordance with the customer’s use of the service and applicable contractual arrangements.
Following confirmed workspace deletion, relevant Autm-held workspace data is scheduled for deletion and is permanently deleted within 30 days, subject to legal, security, backup and other legitimate retention requirements.
6.4 AI Interaction Data
AI interaction data may include:
prompts and instructions;
AI-generated responses;
relevant operational context;
workflow and agent instructions; and
associated processing metadata.
Relevant information may be processed by AI model providers for purposes such as inference, reasoning, classification, summarisation and generation.
Autm applies data-minimisation and privacy controls designed to reduce unnecessary exposure of personal information during AI processing.
Where appropriate and technically feasible:
only information required for the relevant task is passed for AI processing;
personal identifiers may be redacted, tokenised or pseudonymised before information is transmitted to an external AI provider;
mappings between protected identifiers and operational data are secured separately; and
access is controlled according to user and workspace permissions.
Autm does not permit customer data to be used to train public AI models unless explicitly agreed in writing.
Retention:
AI interaction data retained within Autm is retained in accordance with the requirements of the relevant feature, workspace and customer agreement.
Information processed by third-party AI providers is subject to the applicable contractual arrangements, data-processing terms and retention controls governing those services.
Where AI interaction data forms part of organisational memory or another persistent Autm feature, the retention provisions applicable to that feature also apply.
6.5 Organisational Memory and Operational Intelligence
Autm is designed to maintain relevant organisational context over time so that authorised users can benefit from persistent operational intelligence.
This may include:
organisational knowledge;
relevant operational context;
entities and relationships;
decisions and commitments;
actions and outcomes;
information derived from authorised business systems; and
other persistent information required to provide organisational memory.
Unlike temporary AI chat history, organisational memory may need to persist for as long as it remains relevant to the organisation and the authorised purposes for which Autm is being used.
Retention:
Organisational memory is generally retained for the active lifecycle of the relevant workspace or until it is removed, superseded or otherwise subject to applicable retention and deletion controls.
Retention may also be determined by customer configuration, contractual arrangements, the nature of the information and applicable legal requirements.
Where the relevant workspace is deleted, associated organisational memory is included within the workspace deletion process.
6.6 Personal Identifiers, Redacted and Tokenised Data
Personal identifiers such as names, email addresses and telephone numbers may, where appropriate and technically feasible, be redacted, tokenised or pseudonymised as part of Autm’s privacy and AI-processing controls.
Mappings required to associate protected identifiers with authorised operational information are secured separately using appropriate encryption and access controls.
Retention:
Protected identifier mappings are retained only for as long as required for the relevant authorised purpose.
They are included within applicable account, workspace and data-subject deletion procedures.
Cryptographic keys and secrets are protected through secure key-management controls, including Microsoft Azure Key Vault where applicable.
6.7 Billing and Financial Records
Payments are processed through our payment provider.
Autm does not store full payment card numbers or sensitive payment credentials.
Autm may retain:
transaction records;
invoices;
subscription records; and
other information required for accounting, tax and contractual purposes.
Retention:
Relevant financial and accounting records may be retained for up to six years, or longer where required by applicable law, regulation or an ongoing legal matter.
6.8 System Logs, Security and Monitoring Data
This may include:
security logs;
authentication events;
system and application logs;
error information;
performance telemetry;
diagnostic information; and
information required to detect or investigate security incidents.
Logs are designed to minimise the inclusion of personal data wherever practicable.
Retention:
Operational and security logs are generally retained for between 30 and 90 days, depending on their purpose.
Information may be retained for longer where reasonably necessary to investigate a security incident, fraud, misuse, technical failure, legal claim or regulatory matter.
7. Data Ownership
Customer organisations retain ownership of the Customer Data they provide to or make available through Autm.
Using Autm does not transfer ownership of a customer’s underlying data to Autm.
Autm’s rights to process Customer Data are limited to those necessary to provide, secure and support the service, comply with applicable law and perform other processing permitted by the relevant agreement.
Connected source systems remain independent of Autm.
Disconnecting or ceasing to use Autm does not transfer ownership of, or remove information from, those underlying systems unless an authorised Autm action has expressly modified information within that system.
8. Customer Exit and Workspace Closure
Autm is designed to operate as an intelligence and automation layer across a customer’s existing business systems rather than replacing those underlying systems.
If a customer stops using Autm:
its underlying connected systems remain independently accessible subject to the terms of those providers;
ending the Autm service does not remove the customer’s source data from Microsoft, Google, CRM, project-management or other connected systems;
authorised integrations can be disconnected or revoked;
Autm-held Customer Data can be handled in accordance with applicable export, retention and deletion arrangements; and
relevant Autm-held workspace data is scheduled for deletion following confirmed workspace closure, subject to contractual and legal requirements.
Where data export functionality or an agreed exit process applies, Autm will provide the relevant Customer Data in accordance with the customer agreement and technical capabilities of the service.
The precise exit arrangements for organisational customers may also be documented within their contract or Data Processing Agreement.
9. Data Deletion and Erasure
Where deletion applies, Autm uses processes designed to ensure that information is made inaccessible and subsequently removed from active systems.
Deletion may involve:
Stage 1 – Logical deletion
Relevant information is marked for deletion and made inaccessible through normal platform use.
Stage 2 – Permanent deletion
Relevant information is permanently removed from Autm’s active systems within the applicable deletion period, generally within 30 days of confirmed deletion.
Deletion processes may include removal of:
workspace operational data;
AI interaction data retained by Autm;
organisational memory;
associated personal identifiers;
relevant integration credentials; and
protected identifier mappings.
Limited information may be retained where required for:
legal or regulatory compliance;
financial and tax obligations;
security and fraud prevention;
establishing, exercising or defending legal claims; or
other lawful and legitimate purposes.
Where data exists within backups, it may remain within protected backup systems for a limited period until those backups are overwritten or expire in accordance with the applicable backup lifecycle. Such information is not restored to active use except where necessary for disaster recovery or other legitimate operational purposes.
10. Data Subject Erasure Requests
Individuals may have the right to request deletion of their personal data under applicable data protection law.
Where Autm acts as the Data Controller, requests may be made to support@autm.ai.
Where Autm processes personal data solely on behalf of a customer organisation, requests should normally be directed to that organisation as Data Controller.
Autm will provide reasonable assistance to customers in fulfilling valid data subject requests where required.
The right to erasure is not absolute, and information may be retained where an applicable legal basis permits or requires continued retention.
11. Service Providers and Sub-Processors
We use carefully selected third parties to help provide and secure the Autm service.
Our principal service providers currently include:
Microsoft Azure
Used for cloud infrastructure, hosting, secure storage, monitoring and cryptographic key-management services.
OpenAI
Used for certain AI model inference services.
Where OpenAI or another AI model provider processes customer information on Autm’s behalf, appropriate contractual and data-protection controls apply.
Autm does not permit customer data to be used to train public AI models unless explicitly agreed in writing.
Stripe
Used for payment processing and subscription billing.
Autm does not store full payment card numbers or sensitive payment credentials.
Autm may update or replace service providers as the platform evolves. Where providers process personal data on our behalf, appropriate contractual and data-protection safeguards are required.
Where Autm acts as a Data Processor, relevant providers may act as sub-processors.
We maintain information about our current sub-processors and can provide further information on request.
12. International Data Transfers
Autm’s primary customer data infrastructure and data residency are hosted within Microsoft Azure in the United Kingdom.
Some service providers, including AI model providers, may process information outside the United Kingdom or European Economic Area where necessary to provide their services.
Where personal data is subject to an international transfer, Autm uses appropriate safeguards as required by applicable data protection law.
Depending on the circumstances, these may include:
UK adequacy regulations or recognised adequacy arrangements;
Standard Contractual Clauses;
the UK International Data Transfer Addendum or other approved transfer mechanisms; and
additional technical safeguards such as encryption, data minimisation, redaction, tokenisation or pseudonymisation.
13. Security Measures
Autm applies technical and organisational measures designed to protect retained information against unauthorised access, disclosure, alteration, loss or destruction.
These measures include, where applicable:
encryption of data in transit using TLS;
encryption of data at rest;
secure cryptographic key and credential management;
role-based and permission-based access controls;
two-factor authentication (2FA);
OAuth-based sign-up and sign-in;
OAuth-based authorisation for supported third-party integrations;
secure storage and handling of authentication and integration tokens;
monitoring and audit logging;
data minimisation and PII redaction, tokenisation or pseudonymisation controls;
restricted access to personal data on a need-to-know basis; and
secure development and operational practices.
No system can guarantee absolute security. We regularly review our security measures and evolve them as the platform, technology and risk environment develop.
14. Automated Processing and AI Functionality
Autm provides AI-assisted features that may involve automated processing.
Safeguards may include:
human oversight capabilities;
confirmation or approval before relevant actions;
role-based and permission-based restrictions;
audit logging of AI-assisted activity;
data minimisation; and
redaction, tokenisation or pseudonymisation of personal identifiers where appropriate.
AI systems can produce inaccurate or incomplete outputs. Autm is designed to support human decision-making and operational activity, not to remove appropriate human judgement or accountability.
Where AI functionality could be used by a customer to make decisions about individuals, the customer remains responsible for ensuring its use is lawful, fair and appropriate.
15. Data Protection Rights
Depending on the circumstances and applicable law, individuals may have rights including:
access to their personal data;
correction of inaccurate or incomplete personal data;
erasure;
restriction of processing;
objection to certain processing;
data portability where applicable;
withdrawal of consent where processing is based on consent; and
rights relating to certain automated decision-making and profiling.
These rights are not absolute and may depend on the circumstances and lawful basis for processing.
Individuals also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) and, where applicable, the relevant European supervisory authority.
16. Business Continuity and Changes of Ownership
Autm operates across customers’ existing technology rather than acting as the system of record for those underlying services.
If Autm is temporarily unavailable, connected source systems remain independently accessible subject to the availability and terms of those providers.
If Autm is involved in a merger, acquisition, investment, restructuring, sale of assets or other change of control, retained personal data and Customer Data may be transferred where necessary as part of that transaction, subject to applicable data protection law, confidentiality requirements and relevant contractual obligations.
Any successor organisation would remain subject to applicable data protection law and relevant contractual obligations in relation to personal data transferred as part of the transaction.
If Autm ceases providing the service, customer exit, data access, retention and deletion will be managed in accordance with applicable customer agreements, data protection requirements and available technical processes.
17. Policy Review and Changes
We review this policy periodically and following material changes to:
the Autm platform or architecture;
our data-processing activities;
applicable law or regulatory guidance;
retention practices;
security arrangements; or
sub-processor relationships.
The latest version will be published on our website with an updated revision date.
Where a change materially affects the processing or retention of personal data, appropriate notice will be provided where required.
18. Contact Us
For questions about data retention, deletion, data protection or this policy, please contact:
Autm Limited
Little Wood House
Linley
Bishop’s Castle
Shropshire
SY9 5HP
United Kingdom
Email: support@autm.ai
For further information about how Autm collects, uses and protects personal data, please see our Privacy Policy.