Data Residency and Privacy
This page explains where aprity keeps your data, where AI processing takes place, and what you can ask aprity to delete.
Where your data is stored
aprity runs in isolated environments on Microsoft Azure. Each environment has its own database, storage, key vault and compute, and data is never shared between environments.
Your org is attached to one environment at registration, based on your activation code. The setup wizard shows it before you register: This org will be registered on: ….
| Environment | Azure region |
|---|---|
| Europe (France), default | France Central (Paris) |
Active application data for your org (analysis results, generated documentation, configuration, human corrections) is stored in your environment's region. A historical database copy from before the France migration remains in the United States pending a retention decision. An EU-only statement covering all historical copies is therefore not yet established; this must be addressed in your customer-specific residency assessment.
Support tickets opened from the portal are an exception: they are also copied to the support tool the aprity team uses to answer them. Do not put sensitive data in a ticket.
Where AI processing happens
aprity uses large language models to write and explain the documentation and to power the AI assistants. By default these models are hosted on Microsoft Azure AI Foundry, under aprity's Azure subscription.
Aprity's managed GPT deployments use DataZoneStandard on Azure Sweden Central. Inference stays in Microsoft's European data zone; it is not restricted to France or Sweden alone. Global and undeclared endpoints are refused by the pod policy, including the dedicated document-generation adapter.
What is sent to the models is the metadata and configuration being explained, plus the questions users ask the AI assistants. Free-text questions, code, labels and descriptions can themselves contain personal or confidential information. The telemetry scrubber does not anonymize all prompts.
This applies to the models aprity provides. If a user connects an AI client (ChatGPT, Claude, Cursor, GitHub Copilot) through the Remote MCP server, the answers aprity returns are then processed by that client's own provider, under your agreement with them.
For additional requirements:
- BYOLLM (Intelligence plan): a client endpoint needs separate residency qualification and explicit authorization; it is refused by the default EU pod policy. See BYOLLM.
- Contact contact@aprity.ai to discuss your constraints.
What aprity keeps
| Kept | Examples |
|---|---|
| Documentation and analyses | Business rules, processes, object pages, execution graphs, versions and their differences |
| Analysis history | Date, status and configuration of each analysis |
| Human corrections and support tickets | Corrections submitted in the portal, ticket threads |
| Tenant configuration | Plan, registration details, connectors |
| AI assistant history | Conversations with the Story Agent; Org Expert questions (see below) |
| Not kept | Why |
|---|---|
| Raw metadata retrieved from your org | Source blobs are purged at scan completion; excerpts may remain in audit exchanges and derived results |
| Your business records | aprity does not read them |
| Passwords and the Consumer Secret | Never requested or transmitted |
Org Expert questions
When a user asks the Org Expert a question, aprity records the question and the start of the answer, after removing personal data patterns such as email addresses, phone numbers, bank account and card numbers. The user is recorded as an anonymous identifier, not by name. This helps aprity measure usage and improve answers.
You can ask aprity support to switch this off for your tenant. aprity then keeps only technical information (channel, response time, date), without the question or answer.
AI exchange retention
LLM exchange bodies and envelopes expire after 30 days from their last modification; Blob lifecycle processing is asynchronous. Derived LLM analysis cache has a 30-day TTL. Conversations and deliverables follow the service/DPA lifecycle, not a universal 30-day TTL. Financial usage records have separate retention. Responses used for exports explicitly request store=false; this does not disable provider abuse monitoring or prompt caches. Microsoft does not train its foundation models on these API inputs/outputs without permission. A modified-abuse-monitoring exemption has not been established.
Encryption
- In transit: all traffic uses HTTPS.
- At rest: databases and storage are encrypted by the Azure platform; secrets and signing keys are held in Azure Key Vault.
Deleting your data
To have aprity delete the data stored for your tenant (for example at the end of your subscription, or under GDPR Article 17), contact contact@aprity.ai from an administrator's address and give your Salesforce org ID. The deletion receipt must distinguish active data from recovery copies: Blob soft delete lasts 7 days and Cosmos backups have a 30-day restore window. Restore procedures must replay prior deletion requests.
Nothing is stored in your Salesforce org beyond the package's own configuration, which you remove by uninstalling the package.