Data location
Where documents, metadata and backups are stored, and for how long.
Fermium is a hosted service. There is no self-hosted edition. Enterprise customers can have a dedicated instance, operated by Fermium.
Where
Fermium stores workspace data on infrastructure it operates in the United States. This covers documents, metadata, tokens, billing records and backups. Google (sign-in) and Stripe (payments) process the data they need; see the Privacy Policy. If your workspace connects its own identity provider, that provider processes sign-ins under your agreement with it. The optional local-review hosted AI features have an additional data flow described below.
If you access the service from outside the United States, your data is transferred to and processed there. The Privacy Policy describes the transfer mechanisms for the EEA, the UK and Switzerland.
What is stored where
Documents. Files and their versions are kept in Fermium-operated object storage. Version history supports the documented compare and restore operations.
Metadata. Account/workspace records, document settings, sharing, billing and audit records are kept in a database. Authorized search uses an indexed copy of supported document text; the searchable copy is removed with the document.
Backups. A nightly encrypted snapshot of the database is written to object storage and kept for 14 days. Backups are used only for disaster recovery.
Logs. File viewer details and related request logs follow the activity retention for the workspace plan. Daily totals last longer and contain no IP addresses or viewer identities. Other operational logs follow their separate retention policy.
Retention
| Data | Kept |
|---|---|
| A document | until it expires or is deleted, then a 7-day grace period, then removed from storage. A document under legal hold (Enterprise) is kept until the hold is released |
| Deleted content in backups | rolls off within 14 days after purge |
| Account data | while the account exists; deleted within 30 days of account deletion |
| Billing records | as required for tax and accounting, typically 7 years |
| Tokens and grants | while the account exists; revoked rows are kept for audit |
| Workspace audit log | for the life of the workspace; events of a deleted account keep the actor's email as a plain string; viewer records follow activity retention |
| File activity | detail: 0/7/30/90 days; daily totals: 90/365/730/1,095 days on Free/Team/Business/Enterprise |
| Other request logs | up to 90 days |
Encryption
Traffic to both hosts and to every custom domain is HTTPS, with certificates from Let's Encrypt. Backups are encrypted at rest. Passwords, Fermium-issued access and refresh tokens, and SCIM tokens are stored as hashes. Linked MCP credentials are encrypted at rest and used only by authorized server-side operations. The client secret of a workspace's identity provider is stored encrypted with a key derived from a server secret.
Custom domains and edge
Traffic for a custom domain terminates on the same infrastructure as the shared content host; no third-party CDN sits in front of it today.
Content scanning
Fermium does not routinely have people inspect your documents. Authorized service features process content to fulfill your requests. Automated checks for malware, phishing and abuse may run on published content, and reported content or a legal request may require review. Business workspaces can enable secret scanning, which records the file and detected category rather than the credential value.
Hosted AI
Hosted Agent work sends the request and relevant authorized context/tool results to the configured OpenAI or Anthropic model. Connected MCP actions send approved arguments to the configured upstream service. This processing is additional to Fermium's own storage; do not assume a private Fermium session means no third-party inference.
Session content and working documents are encrypted at rest. Sharing requires explicit session access plus the applicable Agent/source permissions. Public deployments receive separately published public knowledge and the current visitor's conversation, not private Agent content. See the hosted-work guide.
Provider data residency, training and retention terms depend on the provider and configured service; Fermium does not make additional guarantees about them.
Export and deletion
Both are self-serve. GET /api/export returns a zip of every document you own: a directory per document with its current files and a meta.json of its settings, and an index.json listing them all. DELETE /api/account, confirmed by typing your email, soft-deletes your documents at once and removes the account after the 7-day grace period; workspace owners transfer ownership first. Support will also run either on request at hello@fermium.app. See Deleting your account.
Account export also includes accessible conversations you own and their saved entries. Agent deletion removes its transcript storage; account purge handles owned runtime data and encrypted transcript objects. These lifecycle paths are separate from archiving, which retains the conversation.