AI Pulse — Data Processing & Privacy Statement

This is a technical accuracy draft, not a signed legal document. It describes what the software actually does, grounded in the shipped code and infrastructure. Your organisation's DPO or legal counsel should review it before relying on it for a DPIA, vendor assessment, or contract schedule — and SYLVA's own legal team should sign off on the final wording before it's issued as a binding statement.

·The processing model in one sentence

AI Pulse is deployed into your own Azure subscription, reads governance/security signals about the AI systems already running there, and stores what it reads in a database inside your own resource group — your organisation controls the infrastructure, the region, and the retention.

1What data is processed

Category	Examples	Source
Directory identifiers	Names, email addresses, and object IDs of people your admins assign a role to.	Microsoft Entra ID (your own tenant).
Administrative activity	Who changed which AI resource's configuration, and when.	Azure Activity Log. The caller is masked before display — a service principal shows as "service principal", a person's email is partially redacted.
AI usage metadata	Call counts, token counts, latency, cost, model name, timestamps — not model input/output content.	Self-hosted Langfuse tracing (runs in your own tenant).
Configuration & governance records	Framework selections, control attestations, evidence metadata, risk classifications your team enters.	Entered directly by your users inside the portal.

2Special categories: personal data in AI content

One feature specifically looks for personal data patterns (email, phone, credit card, national ID formats, IP address) inside recent AI prompt traffic, to flag exposure risk.

It never stores the personal data it finds. The scan produces a count and a type label only — for example, "3 email-pattern matches this week" — never the matched text itself. The underlying content stays only in the trace store (Langfuse, in your own tenant) under your organisation's own retention settings for that store.

3Where data is stored

Database: a PostgreSQL server provisioned inside your resource group, in the Azure region you choose at install.
Secrets: an Azure Key Vault, same resource group, same region.
AI-usage traces: the self-hosted Langfuse instance, same resource group, same region — not a third-party SaaS.
No customer data is copied to a SYLVA-operated database, data warehouse, or analytics system.

4Retention

Data	Default retention	Configurable?
Admin/audit trail	180 days	Yes — an install-time parameter; can be extended (e.g. to multi-year for regulatory retention such as SOX) if your compliance programme requires it.
Database backups	7 days, point-in-time restore	Yes — a standard Azure Postgres Flexible Server setting, adjustable directly in the Azure Portal.
Governance/configuration records	Kept until you delete them	Deletable by your administrators inside the product.

5The one flow that leaves your tenant

Full transparency: exactly one outbound call exists, and here is everything it sends.

Call	Destination	Data sent
Subscription entitlement check	SYLVA's licensing service (Singapore)	Your tenant ID and your per-install subscription key. No customer data, no usage records, no personal data.	outbound

This check confirms your subscription is active. It's cached for 24 hours and tolerates the service being briefly unreachable, so it isn't a live dependency for day-to-day use.

6Data subject rights

Because your data stays in your own Azure tenant, your organisation is best placed to action data-subject requests directly — the same way you would for any other system you operate.

Access / export: query your Postgres database directly, or use the in-product views (Admin Trail, Governance Ledger, Asset Registry).
Deletion: your administrators can remove access assignments, governance records, and configuration data inside the product; database-level deletion is available to whoever administers your Postgres server.
Correction: directory data (names, emails) is sourced live from your own Entra ID — correcting it there is reflected in AI Pulse automatically.

7Who is controller, who is processor

A starting position for your DPIA — confirm the exact wording with your legal team before relying on it.

Your organisation is the data controller for everything processed and stored in your Azure tenant — it's your infrastructure, your data, your retention choices.
SYLVA Labs acts as a limited processor only for the one entitlement check in §5 (tenant ID + subscription key) — the smallest surface consistent with confirming a valid subscription.

SYLVA Labs Pte Ltd · AI Pulse — Data Processing & Privacy Statement. Pre-release draft — pending legal review.

Companion to Azure services, data & security. Describes the current shipping product; update this document whenever the underlying data flows change.

Data processing & privacy statement

Contents

On this page