Privacy and data retention

You control how much moatbox keeps about your spaces with three switches. Owners and admins set them for the whole team in Settings > Privacy. Some can also be set for one space.

The three team modes

On at team level means on for every space, new spaces and forks too. Members cannot turn a team mode off for their own space. Owners and admins change the team policy in the dashboard or with an API key that has the team.admin action. Turning on zero data retention is the exception: it needs a browser session.

Monitoring off

No process list and no command or process history in any space. CPU, memory, disk and I/O samples stay: usage and abuse checks need them.

The space's runtime stops recording commands and processes. Asking a space for its history or process list returns monitoring is off for this space: no process list and no command or process history.

Snapshots off

No automatic history, and no new saved snapshots or share codes. When you turn it on:

• moatbox deletes every space's automatic history for good, right away
• saved snapshots stay until you delete them
• share codes you already made keep working until they expire or you revoke them
• nobody can save a new snapshot or create a share code
• deleting a space takes no final snapshot

Snapshots are covered in Snapshots.

Zero data retention

When you delete a space, moatbox skips the trash and erases the space's snapshots, share codes and records, except the ones listed under It keeps. Sleep that keeps memory still works.

To turn it on you need a signed-in browser session and you type erase space data. No API key can turn it on. Before you confirm, the dashboard counts what it will delete now.

It deletes:

• every saved, automatic and final snapshot of the team's spaces, now
• every share code, now
• spaces in the trash, now; later deletes skip the trash
• after a space is deleted: its metrics, alerts, webhook deliveries, CI job output, run list, approval notices and resets

It keeps:

• billing records: usage, invoices, wallet
• the audit log, with who did what and when
• API key usage counts
• AI usage: requests, tokens and cost per day and model, no prompts
• webhook delivery records for 30 days, or until the space is deleted: event ids, types and small data, never command text or output
• undo points from resets and restores, on the space's server, until they expire or you delete the space
• each deleted space's database row, and its CI job records without their output

It still allows:

• sleep that keeps memory: the state stays on the space's own server
• command output and history: kept inside the space only, never stored by moatbox

Under zero data retention, moatbox saves no CI runner log when a job ends, and run traces carry no command text.

Per-space settings

A space can turn on more than the team does. It cannot turn off what the team policy keeps on; the API answers your team's policy keeps this on.

For one space, snapshots off deletes its automatic history. Zero data retention deletes every snapshot of that space, saved ones too, and revokes its share codes. Deleting the space then skips the trash. Zero data retention for a space also needs a browser session and the typed phrase erase space data.

Settings > Privacy lists the spaces that set more on their own.

curl -X PUT https://app.moatbox.dev/api/v1/spaces/my-space/privacy \
  -H "Authorization: Bearer $MOATBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"snapshots_off": true}'

How long moatbox keeps what

The tables below follow what moatbox does. GET https://app.moatbox.dev/api/v1/retention returns moatbox's own retention list without sign-in, and Settings > Privacy shows that list. Some of its rows describe the data differently from these tables.

Inside the space

On the space's server

In moatbox's database

Close your account

Go to Settings > Privacy, press Close account… and type your account's email to confirm.

What happens now

For each team you are alone in, moatbox:

• closes the team, stops its spaces and moves them to the trash
• cancels the plan
• revokes the team's API keys and pending invites, and turns off automatic top-up

For each team you share with other people, you leave it. The audit log records that you closed your account.

For you, moatbox signs you out everywhere, deletes your SSH keys and push subscriptions, revokes your API keys and the invites you sent, and disables the account. You get an email with the date of final deletion. To change your mind before then, reply to that email.

After 30 days

moatbox deletes each closed team's spaces and their snapshots, then the team itself with its audit log. Then it deletes your user record. If it cannot delete the record, it erases your email, name, avatar and sign-in links from it. The spaces of a closed team stay in the trash for those 30 days instead of the usual 72 hours.

The only-owner rule

If you are the only owner of a team that other people still use, moatbox refuses to close your account:

you are the only owner of <team>, which other people still use: make one of them an owner, or remove them, first

Make another member an owner, or remove the other members, and try again. Roles are covered in Teams.

Closing needs a signed-in browser session. No API key can do it.

API

All routes live under https://app.moatbox.dev/api/v1.