Storage and retention

1What a Silo keeps

Silo keeps nothing from your systems unless your organisation switches on storage and creates a Silo, with one exception: a change to your systems made through Silo, described at the end. Until then every answer is read from your systems and discarded, and nothing else described here exists.

A Silo can capture changes. For each concept it is told to watch, and only for the fields nominated on it, Silo keeps which record changed, which field, the value before, the value after, when the change was seen, and which of your systems it came from. So that it can recognise a change, it also keeps the last value it saw for each of those fields. Nothing else from the record is kept. Capture happens only as people ask questions: a record nobody asks about is never captured, and nothing is fetched from your systems for the sake of storing it.

A Silo can also hold files your organisation imports. The files themselves are kept, together with the records read out of them under a structure your organisation defines and tests against those files. Spreadsheets and CSV files are read column by column, and PDF documents by finding labelled fields and table columns on the page, and neither involves an AI model. Every value read from a document is marked as read from a document, with the page it came from.

What a Silo keeps is stored in Silo's own infrastructure, in the same region as the rest of your organisation's account, and separated from every other organisation. It is never written to logs or copied into the audit trail, and it is never sent to an AI model except in the one case described next.

Your organisation can separately choose to have documents read by an AI model, for contracts, reports and correspondence that have no labels to find. Nothing is sent to a model until a super admin makes that choice, having read what it means, and then only the text of documents your organisation imported into a Silo under a structure that asks for them to be read that way. Every value read like this is marked as inferred, with the model's own score and the passage it came from. Importing spreadsheets, CSV files and PDFs read by label or column never sends anything to a model.

Each Silo has its own retention window, chosen when it is created and never longer than 730 days. A change is deleted once it is older than the window, a last-seen value once it has not been seen for that long, and an imported file, with everything read out of it, once it was received longer ago than that. Past its window it can no longer be read, even before it is deleted.

Anything in a Silo can be deleted at any time: the changes to one record, one imported file with everything read out of it, one concept, or the whole Silo. Each deletion produces a receipt saying what was removed, and your organisation can require a second person to approve it.

Switching storage off stops capture and import immediately. What is already held stays until its window passes or it is deleted.

Changing your systems through Silo does not depend on storage being switched on, and switching storage off does not stop it. Before a change is shown to anybody, Silo reads the records it would alter and keeps, for each one, its identifier and the current value of each of the concept's fields the change would alter or remove, together with the new values proposed. Nothing else from the record is kept. None of it is written to logs, sent to an AI model or copied into the audit trail, which records which fields and how many records a change reaches rather than any value. A change nobody carries out lapses 24 hours after it was prepared and is then deleted with everything it read, and is never kept longer than 30 days. A change that is carried out is kept, together with what each record held afterwards and who approved it, as a receipt for as long as your organisation chooses, a year unless it chooses otherwise, so that it can be reviewed and undone; nothing kept for a change is kept longer than 730 days. Past that it can no longer be read or reverted, even before it is deleted with everything it read. A receipt can be deleted sooner, with everything kept for its change, and your organisation can require a second person to approve that.

2Reading documents with an AI model

Reading documents with a model sends a document's text to Google's Vertex AI, the model Silo already uses to plan questions. It is the one exception to Silo's rule that none of your business data goes to a model, so it is a separate choice from switching storage on.

Only documents your organisation has imported into a Silo, under a structure that asks for them to be read this way, are sent. Spreadsheets, CSV files and PDFs read by label or column are never sent.

The model is used under zero data retention: Google does not keep the text after answering, and this deployment sends no document until that has been confirmed for it. The text is never written to Silo's logs or audit trail.

Every value read by the model is marked as inferred. Its flag shows the model's own score, described as a model score rather than a measured figure, and the passage of the document the value was read from. A value the model cannot point to in the document is refused rather than stored.

A person can confirm a value the model read, after which it is treated as certain. Switching this off stops any further document being sent; values already read stay, marked as inferred, until they are confirmed or deleted.