Data Handling

What Gets Stored

Omnodex stores structured records of agent activity:

• Tool calls (tool name, owning server, parameters, timing, status, and response size; tool output itself is not stored)
• File access events (which files were read or written)
• Session metadata (start and end time, working directory, agent)
• Detection findings (which rules fired, on which tool calls)

Parameters can contain sensitive values such as file contents an agent writes. For MCP servers routed through the Omnodex proxy, set redact_parameters to keep parameter values out of the log.

Where It Is Stored

Free Tier (Local Only)

All data lives on your machine in the Omnodex home directory (default ~/.omnodex, or OMNODEX_HOME):

Path	Contents
event-log/	Append-only event log, one JSONL file per session (source of truth)
traces.db	SQLite read model (derived, rebuildable)
config.json	Local configuration

You own these files completely. Recording and local analysis make no network calls; nothing leaves your machine unless you connect to the hosted dashboard. The CLI does check for updates in the background, which you can turn off with OMNODEX_NO_UPDATE_CHECK=1.

Hosted/Cloud Tiers

When cloud sync is enabled:

• Events are encrypted locally before upload (see Encryption)
• Encrypted blobs are stored in cloud object storage
• The encryption key never leaves your machine
• We store only ciphertext - we cannot read your data

Data Retention

Local

You control retention. Events accumulate in the event log until you delete them. Remove a single session with omnodex clear <session-id>, or everything with omnodex clear --all --confirm.

Cloud

Encrypted event data is retained according to your plan:

• Hosted: 90 days
• Pro: 1 year
• Enterprise: Configurable (up to unlimited)

Deletion is permanent. When data is purged from cloud storage, it is gone - we do not hold backup copies of customer data.

Data Portability

The event log is standard JSONL, documented in the Event Schema. You can:

• Copy it to another machine
• Process it with any tool that reads JSON (jq, Python, etc.)
• Import it into your own systems
• Archive it to your own storage

There is no lock-in. Your data is always yours in a standard, documented format.

Next Steps

• Encryption - How zero-knowledge encryption works
• Security Model - The overall security architecture