Configuration

Configuring Message Retention

View as Markdown

Use the Privacy tab to decide how long message text stays readable. After the horizon you choose, the Agent overwrites that text in place. Conversation rows stay so statistics and Chat Logs still have a record of the turn.

Purpose

Choose a retention horizon, pick whether expired text is replaced entirely or only has personal data removed, and optionally send anonymize passes through an external redaction service.

Prerequisites

  • A configured Agent. See Quickstart.
  • Permission to edit Agent settings for your team.
  • The Message Redaction feature enabled for your team. The Privacy tab is hidden until that flag is on.

Steps

1

Open the Agent's Privacy Settings

Select Agents in the left-hand navigation, open your Agent, then choose the General page and the Privacy tab.

2

Choose a Message Retention Horizon

Message Retention Horizon is how long a message stays readable after it is sent. Options start at 1 minute and go up to 12 months.

Leave it as Never to keep message text indefinitely. The redaction mode and external service controls stay visible but disabled until you pick a horizon. Clearing the horizon back to Never also clears those settings.

3

Pick a Redaction Mode

With a horizon selected, choose how expired text is rewritten. Scrub Entirely is selected by default.

  • Scrub Entirely replaces the message with a placeholder. Use this when you do not want leftover wording after the horizon.
  • Anonymize Surgically keeps the rest of the text and redacts detected personal data such as emails, phone numbers, payment cards, national-id-like digits, IP addresses, US street addresses, calendar dates, and names that are introduced in the message. First-person cues cover every language the Agent ships, for example “My name is …”, “Me llamo …”, or “我叫…”.

If a horizon is set and the mode is unset, the Agent treats the mode as scrub.

4

Use an External Redaction Service (Optional)

Use External Redaction Service is available only when the mode is anonymize. When it is on, anonymize still runs the built-in pattern pass first, then may send message text, notes, and similar fields to Azure Language Text PII on the Agent host. Stored completion input is rewritten from the already-redacted conversation text and is not sent to that service.

Turn this on only when that Azure resource is configured on the host. If the service is missing or the call fails, the Agent keeps the pattern-redacted text and continues. Message text is never sent to the Agent’s chat model for redaction. Each turn that uses the service is billed the configured redaction-service credit cost.

5

Save And Confirm

Select Save Changes. New messages stay readable until they pass the horizon. A long-running conversation keeps recent turns readable while older turns redact in place.

Expected Result

After the horizon, message text in Chat Logs shows a placeholder or anonymized wording. Token counts, likes, flags, and identity fields used for analytics stay. Rows are never deleted.

Immediate Erase

Retention is scheduled. To rewrite stored wording right away, call the Agent API scrub or anonymize endpoints for one user or one chat completion. You choose the mode and the scope on that request. Identifiers such as external_id are not cleared. See Scrub And Anonymize.

What Is Rewritten

Retention and the API endpoints rewrite the same kinds of stored text: message content and translations, completion notes, search queries, evaluation text, and similar fields attached to the turn. Completion input is updated by replacing the original conversation wording with the redacted message text. If that swap cannot be applied on the turn that stored the input, the field is cleared.

They do not remove rows, unlink external_id or referral codes, delete user flags, or change session geography. Copies already sent (webhooks, notification email, or error reports) are not recalled.

Troubleshooting

  • The Privacy tab is missing. Message redaction is gated by a feature flag. Confirm it is enabled for the team.
  • Mode and the service toggle are greyed out. Choose a Message Retention Horizon first. The service toggle also stays disabled unless the mode is anonymize.
  • Chat Logs still show the original wording. The horizon is measured from each message’s sent time. Recent turns stay readable until they age past the setting.
  • A user asked to be forgotten immediately. Use the Agent API scrub or anonymize endpoints for that user or for a single chat completion. The hourly job only processes text that has already passed the horizon, plus leftover rows from an API request that did not finish.

Next Step

Continue to the Standalone Web UI when you are ready to publish the Agent, or review Scrub And Anonymize for the GDPR endpoints.