1. Data ownership and location
| Data | Source of truth | Cloud treatment |
|---|---|---|
| Raw signals, payloads and dimensions | ClickHouse on the selected node | Not sent to browser, Vercel or Supabase |
| Rules and local evaluator state | Node configuration and ClickHouse | Not replicated by default |
| Identity, organizations and memberships | Supabase control plane | Authorized console access only |
| Heartbeats, rollups and incidents | Supabase summarized control plane | Scoped by organization; no raw payload |
| Alert secrets and delivery metadata | Encrypted control-plane records and durable delivery state | Secrets never shown to browser |
2. Deployment profiles
- On-premise: the customer controls the host, ClickHouse volume, backup destination and data residency. Tucunar requires outbound HTTPS only when cloud summaries are enabled.
- Cloud-managed: Tucunar operates the node profile and must record the hosting region, access controls, backup policy and deletion process before customer production data is enabled.
- Air-gapped: raw data, evaluation, dashboard and local alerts remain inside the isolated environment. Cloud reporting is disabled, so an external local monitor is required.
3. Retention baseline
| Data | Baseline | Owner of final decision |
|---|---|---|
| Raw signal rows and payload TTL | 395 days by default; configurable from 1 to 3,650 days | Customer/order form |
| Incident and local delivery state | 13 months in the node baseline | Customer/order form |
| Completed cloud outbox rows | 30 days; pending rows are not removed by TTL | Tucunar operating policy |
| Backups | Operator-defined and stored outside the application volume | Customer for on-premise; Tucunar for managed cloud |
4. Deletion, export and recovery
Before production, the parties must record how an organization requests control-plane deletion, how the customer exports authorized audit evidence, how node data and backups are deleted, and how long deletion may remain in immutable or offline backups. On-premise deletion is performed by the customer operator using the documented retention and storage procedures.
Backups are not a substitute for a deletion policy. Every pilot should record the observed backup and restore duration, recovered row count, target RPO/RTO and the responsible operator.
5. Minimization and support
Send normalized signals rather than credentials or complete provider payloads when they are not necessary. Configure redaction before insertion. Diagnostic exports should contain versions, readiness, bounded metrics and delivery status, never `.env` files, tokens or raw signal bodies.
6. Customer data annex checklist
- Customer and Tucunar data owners.
- Hosting profile, region, network egress and approved destinations.
- Signal fields, personal-data assessment and redaction keys.
- Raw, incident, outbox and backup retention.
- Export, deletion, legal hold and restore procedures.
- Subprocessors, support access and incident notification.