Know where your organisation's data is kept, who can reach it, what leaves your Sasha and how secrets are protected

Where Sasha keeps files and chats, how long chats are kept, what your AI provider keeps, what data leaves your Sasha, and how Sasha protects the secrets it stores.

Where

Settings → General (Session retention, Activity Logging) and Settings → AI Admin (the AI provider). Most of this page describes how Sasha works, not a screen.

Who

Admins choose the AI provider and the retention settings. Everyone's data follows the rules on this page.

Needs

Nothing to set up. Some choices, such as the improvement export and the server's encryption key, are server settings that your technical operator controls.

What it is

This page goes deeper than Where your data lives in Sasha. It is for the admin who must answer questions about data protection: where things are kept, how long, who can reach them, what leaves your Sasha, and how secrets are stored.

One Sasha per organisation

Each organisation has its own Sasha: its own server, storage and database. Your Sasha runs in your organisation's cloud account, or Context is Everything hosts it for you.

Who can reach what

• Admin and staff can reach every project. Admin and staff accounts can see and work in every member's home.
• Members reach only their own home and the shared projects an admin grants. A member's home is private from other members. A project a member cannot reach gives the same "Not found" as a project that does not exist.
• An organisation that needs homes that no admin can see needs its own Sasha.

For roles and grants, see Understand exactly what each role can do, what keys and system accounts can reach, and what Sasha records.

How long things are kept

Both settings are in Settings → General (admins only).

• After the retention time, Sasha deletes the chat and you cannot open it again.
• With Forever, transcripts build up without limit. Watch the disk space in Settings → System.
• Documents, members' homes and the audit records have no retention setting. Sasha keeps them until someone deletes them.

Your AI provider

Sasha sends your prompts, and the parts of documents a chat reads, to the AI provider that an admin chose in Settings → AI Admin. See Choose where Sasha's AI runs, which model it uses, and how much it can read at once.

AWS allows Fable models only when the account's data-retention mode is aws_review. AWS then keeps those requests for up to 30 days for possible human review, inside AWS, and does not share them with Anthropic. The Bedrock card says "Your data never leaves your AWS infrastructure". It does not mention this review period. Ask who owns the AWS account: it can be your organisation's account or your hosting provider's.

What leaves your Sasha

Improvement suggestions. Each suggestion holds a short summary and an optional detail. Before the team collects it, Sasha replaces email addresses and file paths with "[redacted]", replaces user, connection and chat identifiers with one-way codes, and limits the detail to 2 KB. The kind, severity, project name and tool name (including the names of your own connected services) are sent as they are. A server setting stops the export; there is no screen for it.

Session signals. Every 6 hours, Sasha scans chat transcripts for fixed patterns, such as a tool that keeps failing. If your Sasha uses AWS Bedrock, a small model writes a short description of each signal, under a rule not to quote the transcript. The code calls this rule a best effort, not a guarantee. The description becomes an improvement suggestion.

Report Issue. The form sends your text, the page address, browser details and recent log messages to a GitHub issue. The log messages go into a separate unlisted GitHub page that anyone with its link can read. Sasha saves the screenshot on your own Sasha and copies it to your clipboard. It reaches GitHub only if you paste it in. If you type an email address, it becomes a label on the issue. If the server cannot file the issue, Sasha opens a pre-filled GitHub page in your browser instead.

Browser analytics. If your Sasha was built with PostHog, the browser sends page views and clicks with your user number, username and admin flag. To find out whether yours was, ask Context is Everything. It respects Do Not Track. No setting in Sasha turns it off.

Claude connections. Sasha logs each request that Claude makes to your Sasha. That log stays on your Sasha and is not sent elsewhere.

How stored secrets are protected

For the last row, the server needs an encryption key setting. Today, if that setting is missing, Sasha falls back to a built-in key and gives no warning. A secret encrypted with the built-in key is only as safe as the server's storage. A move to the stronger method is planned. Ask your technical operator to confirm that your Sasha has its own key.

Limits to know

• Today, most connection secrets use the older encryption method, and a missing key setting falls back to a built-in key.
• The Bedrock card does not mention the 30-day AWS review period for Fable models.
• There is no screen to stop the improvement export or the session signal scan. Both are server settings.
• The Activity Logging text speaks of "audit depth", but the audit records of sign-ins and permission changes have no retention setting and no screen.
• The table of what leaves your Sasha may not be complete. Sasha does not switch off the usage reporting of the Claude tool it runs, and what that tool sends is not confirmed.
• If your Sasha was built with PostHog, no setting in Sasha turns it off. A browser with Do Not Track switched on sends nothing.