Settings
Which organization this credential belongs to, whether it is provisioned, and the policy that governs how long captured frames would be kept.
Everything here is read-only, on purpose. Retention configuration is deliberately excluded from every surface an agent can reach — an agent that could shorten its own audit retention could erase the record of what it did. It is changed operations-side, against the database. This page shows the platform's defaults and ceilings rather than your organization's own row, because no endpoint serves that row to a browser.
Provisioned, with the instant it became so. Every value on screen names the field or the constant it came from.
Organization
- Organization id
- Your role
- Signed in as
- Issuer
Read from the token on this tab, not from the server. The signature is not checked here and cannot be in a browser. These are what the credential claims about itself; the API is what verifies them on every request.
Provisioning
- Provisioning status
activeProvisioned. This is the state in which the rest of the console has data to show.- Since
- 2026-08-14T09:22:41.000Z
One of four values from GET /v1/admission: none, pending, active, revoked. It answers only about your own organization, from your own token.
Frame retention
No frame bytes are being stored today. The retention schema, the expiry arithmetic and the deletion sweep are all built, but nothing on the product path writes a frame yet. The policy below is what would govern them — it is not a description of data that exists.
- Default retention class
debugThe default for an organization with no configuration row. Short by design — minimization first, so a path that starts persisting never inherits a “keep it and govern it later” backlog.- Default retention
- 1 dayWhat an organization with no configuration row gets. A missing row is minimization by default — it does not mean unlimited retention.
- Default delete mode
hard_deleteThe object is deleted from storage and its metadata row is marked. Simple, with no extra trust surface, and right for most organizations.- Archiving
archiveEnabled: falseFalse for an organization nobody has named, so turning storage on for the first time archives nothing until an operator opts an organization in. The deletion sweep is global regardless, so nothing that was ever written can be stranded.- Ceilings
debug— at most 3 days. The default for an organization with no configuration row. Short by design — minimization first, so a path that starts persisting never inherits a “keep it and govern it later” backlog.audit_opt_in— at most 90 days. Only when an organization explicitly asks for it. Longer retention for audit purposes, still under the ninety-day ceiling the migration enforces as a CHECK constraint.
A global 90-day cap sits above both and is enforced as a database CHECK constraint, not only in application code. A request above a ceiling is refused outright rather than quietly clamped, so an operator finds out they did not get what they asked for.
- Delete mode
hard_delete— The object is deleted from storage and its metadata row is marked. Simple, with no extra trust surface, and right for most organizations.crypto_shred— Each frame is encrypted under a key wrapped by an organization key; expiry destroys the wrapped key, so the ciphertext becomes unreadable immediately even where the storage layer deletes lazily. Not an alternative to deletion — deletion still runs.
This page cannot change any of it, and neither can anything else you can reach. Retention configuration is deliberately kept off every surface an agent can call. An agent able to lower its own audit retention could erase the record of what it did, so the capability is excluded structurally rather than by permission — the tool set is asserted not to contain one.
Changes are made operations-side, directly against the database. If your organization needs a different retention class or window, that is a request to whoever operates your deployment.
And these are the platform's defaults, not your organization's values. Your organization's configured row, if it has one, is not readable from a browser — there is no endpoint that serves it. This console will not guess at it, so what is shown is what an unconfigured organization gets and what the ceilings are.