Data handling

Inputs, outputs, and saved facts

FennoraDesk processes structured records you choose to submit. It does not read arbitrary documents, fetch a URL, scrape a site, or connect to a business account.

Supported inputs

Use the input schema shown in each workspace. JSON is limited to 2 MiB. CSV and XLSX uploads are limited to 10 MiB and 10,000 rows. XLSX files are checked for formulas, external relationships, macros, and unsafe archive members. PDF and scanned invoice reading are not supported.

Memory-only processing

Analysis inputs and results are not saved by the application. They stay in request memory long enough to produce the response. The web workspace does not put access tokens in a URL or browser storage.

Source Memory limits

Source Memory stores at most 5,000 current facts and 25 revisions per fact, up to 25 MiB of encrypted record data per account. A save that would exceed a limit fails without silently replacing or dropping older facts. Search and export return a signed next-page cursor when more results remain. Full export downloads every page and revision.

Account scope

Tenant identity comes from the verified OIDC issuer and subject. It is never accepted from a request field. Search, export, save, and delete use parameterized queries and include the authenticated account boundary.

Plugin processing

When you use a ChatGPT or Codex plugin, the ChatGPT or Codex platform receives the request inputs and tool results and handles them under its own data controls and policy. FennoraDesk cannot control that platform's retention.

Provider processing and backups

Railway hosts the production data volume, and Auth0 handles sign-in. These providers and optional Stripe may process network, sign-in, or payment metadata under their own policies. Automatic daily and weekly backups are enabled for the production data volume: daily backups are kept for six days and weekly backups for 27 days. Manual backup expiry follows the provider's recorded expiry date; no fixed duration has been confirmed for the current manual copy. Backup copies can retain deleted Source Memory records until those copies expire or are separately removed. A backup becomes available only after it has completed. Provider processing is separate from the application's handling of submitted analysis records.