Data handling
What Thoth keeps of your agents' tool arguments, prompts and tool output, where, and for how long.
Thoth records a decision for every action an agent asks to take. This page says what that record contains, and how your workspace controls the parts that can hold sensitive data: tool arguments, prompts and tool output.
What every decision record contains
- The agent, the person it acts for when known, the tool and the session.
- The decision (
ALLOW,STEP_UP,DEFER,MODIFYorBLOCK), the rule or reason that produced it, and whether a model risk score took part. A score can raise a decision but never lower it, so no model produces anALLOW. - A signed decision receipt. Receipts and compliance evidence hold a hash of the tool arguments, never the arguments themselves.
Tool arguments, prompts and tool output
Agents and the MCP proxy can send Thoth the arguments of a tool call, the prompt and model output around it, and the tool's result. Your workspace decides what Thoth keeps of each.
| Setting | Choices | Default |
|---|---|---|
| Tool arguments | store as sent, hash each value, redact each value to its type, or drop | hash |
| Prompts, model output and tool results | store, hash the whole text, or drop | drop |
With the defaults, Thoth keeps the shape of a tool call (its argument names) with each value replaced by a hash, and keeps no prompt, model output or tool result.
Hashes are HMAC-SHA256 with a key specific to your workspace. Equal values produce equal hashes within your workspace, so you can still match and count identical calls. Short values, such as an account number, cannot be recovered by guessing, and hashes from different workspaces do not match each other.
The setting is applied when data reaches Thoth, before it is queued or stored, to:
- events from the SDKs and the MCP proxy (
POST /v1/events/batch); - the replay snapshots trial workspaces use to improve decisions.
Data already stored keeps the setting it was stored under.
The setting applies on Thoth's servers. Dropping data in the SDKs and the proxy, so that it never leaves your environment, is planned.
Changing the setting
Terraform, MCP and thothctl paths for this setting are being added. Until they are available,
ask in your workspace's support channel to change it.
Where data is kept
Trial and self-serve workspaces run on Thoth's hosted service in the United States: compute in
Azure West US 2, and queues, keys and storage in AWS us-west-2. Thoth is hosted only; running it
in your own cloud or air-gapped is not available yet.
How long
Agent events, including the decision records above, expire after 90 days.