Hosted data practices

Scope

These practices apply to the hosted app at opensuitemcp.com. If you self-host, chats and secrets live in your Postgres. See org-hosted architecture.

Chat history

Hosted is for evaluation. Chat threads can include prompts, tool calls, and NetSuite data the connector returns into the session. We do not keep a long-lived archive of that.

• Threads with no activity for 7 days are deleted on a weekly schedule (last message, or thread start if it never got a message). Messages, votes, and stream records go with the thread. A thread started earlier stays if you keep using it.
• Account sign-in (email or Google) is not wiped with chats. You can still sign in; the sidebar will not keep old threads past retention.

NetSuite credentials

OpenSuiteMCP does not store NetSuite user passwords. Connect uses Oracle’s AI Connector OAuth flow. Access and refresh tokens for that connect are stored encrypted at rest (AES-256-GCM, same key material as BYOLLM API keys). Integration / DCR client material is used to complete OAuth — it is not a warehouse of ERP passwords.

BYOLLM keys

Provider API keys you enter (Google, Anthropic, OpenAI) are encrypted at rest in Postgres. Hosted does not run a shared multi-tenant model account.

What still leaves the app

Encryption at rest and stale-chat deletion do not keep a session on-device. While you chat:

• Messages, tool results, and skill context go to the LLM provider whose key you pasted.
• MCP tool calls go to NetSuite’s AI Connector for the account you connected.

Prefer self-host when policy requires the UI, database, and keys on infrastructure you operate.

Other hosted records

• Account email (and Google account identity if you used Google sign-in) stays until you ask us to remove the account.
• The public demo waitlist is a separate signup table — not chat history.