The Compliance panel gives you four levers: how long conversations are kept, whether sensitive details are scrubbed from stored messages, which biases the agent self-checks for, and whether security-relevant events are logged.
Find these settings under Settings → Compliance on any agent.
Data retention
Choose how long conversations and messages are kept before they're deleted: 7 days, 30, 90, one year, three years, or indefinite.
- A background sweep runs once a day (off-peak) and deletes conversations older than the cutoff. Their messages go with them.
- The sweep is per-agent — different agents on the same team can have different retention windows.
- Set retention to Indefinite if you need to keep history forever; otherwise the cutoff is enforced automatically.
PII redaction
Turn on PII redaction and the agent scrubs sensitive patterns from user and assistant messages before they're stored:
- Email addresses →
[REDACTED_EMAIL] - Phone numbers →
[REDACTED_PHONE] - Credit card numbers →
[REDACTED_CARD] - US Social Security numbers →
[REDACTED_SSN] - IBAN bank account numbers →
[REDACTED_IBAN]
Redaction happens at write time. The original sensitive text is not retained anywhere — only the scrubbed version ends up in the database.
Bias guardrails
Pick the bias categories you want the agent to actively check against before replying: gender, racial, age, religious, political, socioeconomic, disability, cultural, linguistic, appearance.
Selected categories are added to the agent's system prompt as a self-check instruction: "Before responding, revise your answer if you detect any of these biases." The model treats people fairly across the dimensions you pick.
Ethical risk management
A higher-level set of categories that layer on top of bias guardrails. Available risks:
- Privacy concerns — refuse to leak or speculate about personal information.
- Bias detection — re-check responses for discriminatory framing.
- Misinformation — refuse to assert facts that can't be verified.
- Harmful content — refuse content that could enable physical, financial, or emotional harm.
- Deepfake / impersonation — decline to generate impersonations of real people without consent.
Like bias guardrails, selected categories are folded into the system prompt so the agent self-checks before responding.
Audit logging
Turn on Enable Audit Logging to record security-relevant events for this agent:
tool.executed— every successful tool calltool.failed— every failed tool call with its errorwebhook.dispatched— outbound webhook deliveriesretention.purged— conversations removed by the daily retention sweep
Audit rows are kept for 180 days and then auto-pruned. Export to cold storage if you need longer retention for compliance reasons.