Azimuth Data Governance
Version 1.1 — 20 August 2026 Scope: How customer data moves through Azimuth — classification, gates, provider boundaries, retention, and rights. Companion to Azimuth Cloud Security Posture (platform) and Azimuth Dashboard Security Posture (application gates).
Claims are tagged [Implemented] / [In progress] / [Roadmap] — controls are described exactly as they stand, never ahead of it.
1. Governance principles
- Classify at the door. Data gets a classification the moment it enters, and the classification travels with it everywhere.
- Least privilege by stage. Each pipeline stage sees only the data classes it needs.
- Nothing moves without a gate. Every hop — ingest, analysis, generation, approval, publish, export — has a named control.
- Provenance or it doesn't exist. Every fact carries source, timestamp, and reliability; every action carries actor and version.
- Append-only history. Governance data (approvals, audit log, evidence) is never overwritten.
- Honesty in claims. We describe controls as they are — implemented, in progress, or roadmap.
2. Data inventory & classification
| Class | Definition | Examples | Handling rule |
|---|---|---|---|
| Public | Already published or intended for publication | Live posts, public metrics | Freely usable in agent context |
| Internal | Operational, low harm if leaked | Calendars, task lists, drafts | Usable in context; not quoted externally without review |
| Confidential | Business harm if leaked | CRM exports, performance data, strategy docs, contracts | Usable as agent context; never verbatim in output without evidence-backed approval |
| Restricted | Legal/regulatory/contract harm | Program names, export-controlled / ITAR-DFARS-adjacent technical data, non-public financials, personal data (PII) | Labeled at ingest; referenced, never quoted in generation; span-level block if it appears in copy; excluded from provider calls where feasible |
Classification is assigned by the guardrail scan at ingest and can be raised (never silently lowered) by the compliance auditor. [Implemented — behavior in the pipeline; the written policy is this document together with the data-handling rules adopted 10 August 2026]
3. The data lifecycle and its gates
INGEST → CLASSIFY → STORE → USE (agent context) → GENERATE → AUDIT → APPROVE → PUBLISH → MEASURE → RETAIN/DELETE
│ │ │ │ │ │ │ │ │
DG1 DG2 DG3 DG4 DG5 DG6 DG7 DG8 DG9
| Gate | Control | Status |
|---|---|---|
| DG1 Ingest | Only authenticated org members can import; source, owner, and date recorded; unreadable/undated content marked low-reliability | [Implemented] |
| DG2 Classification / guardrail scan | Every source scanned before becoming agent context; restricted spans labeled; embedded instructions flagged as security events and fenced as data before any prompt — containment applies to every untrusted span (uploads, voice transcripts, live web research) whether or not a pattern matched, so it holds against phrasings the scanner has not seen | [Implemented — the fence and the security-event scan shipped 10 Aug 2026] |
| DG3 Storage | Encrypted at rest across the database and backups (verified 11 Aug 2026); org-scoped access; no customer content in logs | [Implemented] |
| DG4 Use / agent context | Least-privilege by stage; restricted content referenced, never quoted; evidence carries provenance (source, as_of, reliability, expiry) | [Implemented] |
| DG5 Direct-to-provider API | Generation calls go server-side, directly to the model provider — no third-party middleware or aggregator in the data path; provider contracts prohibit training on customer data; subprocessor register maintained | [Implemented — path traced end to end 10 Aug 2026; register live. Note we hold no zero-data-retention agreement; Anthropic's standard 30-day API retention applies] |
| DG6 Compliance audit | Span-level scan of all output: unsupported claims, restricted data, rights, disclosure, accessibility; verdict pass/revise/block; a block stops the pipeline | [Implemented] |
| DG7 Human approval | Named approver, per artifact version; flagged items un-approvable until edited or acknowledged; ApprovalRecord is append-only (artifact hash, approver, decision, timestamp) | [Implemented] |
| DG8 Audit log | Every run logged end-to-end: model version, prompt version, sources retrieved, outputs, flags, approvals, publish actions with external post IDs; versions on edit, no overwrites | [Implemented] |
| DG9 Retention & deletion | Self-service export and password-confirmed account-and-organization deletion with cascade, both from Settings, both audit-logged | [Implemented — live tooling] |
| DG9b Retention windows | Default retention is indefinite — data is held until the customer deletes it. Deletion reaches the live database immediately; encrypted backups expire automatically at 35 days under a storage lifecycle rule (enforced by the platform, not by anyone remembering), so deleted data ages out of every backup within that window. Model providers delete API inputs and outputs within 30 days under their own terms | [Implemented — lifecycle rule live 10 Aug 2026] |
4. Provider & subprocessor boundary (DG5 in depth)
This is the question every financial-services and GovCon reviewer asks first: where does our data go when the AI runs?
- Customer content used for generation is sent from the Azimuth API directly to the foundation-model provider's endpoint. There is no analytics middleware, no prompt-logging proxy, no third-party orchestration SaaS in the path. [Implemented]
- Provider terms must include: no training on customer data, defined retention (zero-retention tier where available), breach notification, and audit-relevant documentation (SOC/ISO reports). [Implemented across all three providers — Anthropic Commercial Terms §B and LTX API License §4.2 contractually prohibit training; the LiveKit project moved to the paid Ship plan on 10 Aug 2026, which excludes it from their model improvement program. No exceptions remain. See the register — plan tier is now part of the quarterly re-verification, because a downgrade would silently falsify this row.]
- We do not hold a zero-data-retention agreement with any model provider. Anthropic's standard 30-day API retention applies. [Accurate as stated — do not claim ZDR]
- Restricted-class spans are excluded or masked from provider payloads where the task permits. [Roadmap — masking layer]
- The subprocessor register (provider, purpose, region, terms, data classes sent) is available to customers and kept current. [Implemented —
Azimuth_Subprocessor_Register.md, 10 Aug 2026]
5. Roles & accountability
| Role | Owns |
|---|---|
| Data owner (customer org admin) | What is imported; classification disputes; deletion requests |
| Approver (named human per org) | DG7 — final content approval; flag acknowledgments |
| Azimuth security owner | Gates DG1–DG9 operating as documented; incident response; subprocessor register |
| Agent (bounded) | Operating strictly inside the gates; surfacing flags; never approving, publishing, or reclassifying downward |
6. Customer data rights
- Export of their content, evidence records, and audit trail on request. [Implemented — self-service endpoint, audit-logged]
- Deletion on offboarding with confirmation. [Implemented — password-confirmed, cascades the organization and its records immediately; backups age out automatically at 35 days (DG9b), so deletion becomes complete across all copies within that window]
- Visibility: the Trust Center and GovernanceBar show live gate status; this document set is available for due diligence. [Implemented]
7. Regulatory mapping (summary)
- GLBA: financial-institution customer data treated as Confidential/Restricted; encryption in transit/at rest; no copying to uncontrolled channels.
- GDPR: personal data classified Restricted; direct-to-provider flow documented; deletion rights supported (DG9).
- ITAR/DFARS sensitivity: export-controlled technical data treated as Restricted with span-level output blocking; we do not claim ITAR registration — we prevent the leak vector.
- PCI-DSS / HIPAA: out of scope by design — Azimuth does not process cardholder data or PHI, and DG2 flags either if a customer imports it.
Change log
| Date | Version | Change |
|---|---|---|
| 2026-07-17 | 1.0 | Initial document. |
| 2026-08-20 | 1.1 | Corrected to current, verified state for external use: DG3 encryption-at-rest verified (11 Aug); DG9b rewritten — the 35-day backup lifecycle rule shipped 10 Aug, superseding the "does not yet reach backups" gap; §6 deletion row aligned; endpoint paths removed per the redaction checklist; unverified-claim tags cleared. |