> ## Documentation Index > Fetch the complete documentation index at: https://docs.bowerlabs.ai/llms.txt > Use this file to discover all available pages before exploring further. # Data privacy > How Bower protects your research data — encryption, isolation, and access controls. Your research data is sensitive. Bower is built with security at every layer — from how data is stored and transmitted, to how access is controlled and audited. ## Encryption ### In transit All data between your browser and Bower's servers is encrypted using TLS. This includes: * Every API request and response * File uploads and downloads * Real-time WebSocket connections * Voice and video streams in live agent mode There is no unencrypted path to Bower's infrastructure. ### At rest All data at rest is encrypted using AES-256: * **Database** — all notes, collections, metadata, and user records are encrypted at the storage layer. * **File storage** — all uploaded files (images, audio, PDFs, documents) are encrypted at rest. * **Backups** — database backups are encrypted automatically. Encryption keys are managed by the cloud infrastructure and are not accessible to application code. ## Workspace isolation Workspaces are fully isolated at the database level — not just in the UI. * Every database query is scoped to the current workspace. There is no API endpoint that can return data from a workspace you don't belong to. * Workspace membership is verified on every request before any data is returned. * Files are stored in workspace-scoped paths and are only accessible via time-limited signed URLs (24-hour expiry). * Bird and search are scoped to your current workspace. They cannot access data from other workspaces. This isolation is enforced in middleware, not application logic — it cannot be bypassed by a misconfigured route or a new feature. ## Authentication and access control * **Token verification** — every API request includes a signed authentication token that is verified server-side before any data is returned. * **Email verification** — unverified email addresses are blocked from accessing workspace data. * **Token expiry** — expired or revoked tokens are rejected immediately. * **Role-based access** — four roles (Owner, Admin, Member, Guest) with a strict hierarchy enforced at the API level. ## Audit trail Every create, update, and delete action in your workspace is logged with: * Who performed the action * What changed (field-level diffs with before and after values) * When it happened * The IP address and user agent of the request Audit logs are accessible from the **Audit log** link in the sidebar (or directly at [app.bowerlabs.ai/audit](https://app.bowerlabs.ai/audit)) and can be exported to CSV. See the [audit logs guide](/trust-centre/audit-logs) for details. ## AI processing When Bower processes your data — voice transcription, photo text extraction, or Bird conversations — the content is sent to AI model providers for inference. **Your data is not used to train AI models.** For exactly which providers we use, where your data goes in transit, how long it's kept, and how to lock it down, see [AI & your data](/trust-centre/ai-data-handling). For the full list of every service that processes your data, see our [sub-processor list](/trust-centre/sub-processors). ## Your data rights You have full control over your personal data in Bower: * **Export your data** — download a complete copy of all your personal data (profile, workspaces, projects, artifacts, audit history) as a JSON file from **Settings > Privacy > Export my data**. This covers your data across all workspaces. * **Delete your account** — permanently remove your profile and all associated data. See the Deletion section below. * **Cookie preferences** — control which cookies Bower uses. See our [cookie policy](/trust-centre/cookies). If you have questions about your data or want to exercise your rights, contact our Data Protection Officer at [privacy@bowerlabs.ai](mailto:privacy@bowerlabs.ai). ## Deletion When you delete notes, attachments, or collections, they are **moved to trash** for 30 days. During this period you can restore them from **Trash** in the sidebar. After 30 days, trashed items are automatically and permanently deleted from the database and file storage. * **Deleted notes and attachments** are moved to trash. They are excluded from search, share links, and all normal views while in trash. * **Deleting a collection** moves all notes and sub-collections within it to trash. * **Deleting your account** permanently removes: * Your profile information (email, name) * Your workspace memberships and OAuth integrations * Your Firebase authentication record * Workspaces where you are the sole member (and all content and files within) **In shared workspaces** (where other members exist), your notes, files, and collections are kept for the team — ownership is transferred to the workspace admin. Only your membership is removed. Audit logs are anonymized (the record of what happened is preserved, but your identity is removed). We recommend [exporting your data](#your-data-rights) before deleting your account. ## Data protection officer Our designated Data Protection Officer (DPO) is David Lyon. For any privacy-related questions, data subject requests, or concerns: * **Email:** [privacy@bowerlabs.ai](mailto:privacy@bowerlabs.ai) * **Response time:** We aim to respond to all requests within 30 days, as required by GDPR. ## Further reading * [Sub-processor list](/trust-centre/sub-processors) — all third-party services that process your data * [Cookie policy](/trust-centre/cookies) — what cookies we use and how to manage them * [Audit logs](/trust-centre/audit-logs) — track every change in your workspace * [Privacy Policy](/trust-centre/privacy-policy) — full legal privacy policy * [Terms of Service](/trust-centre/terms-of-service) — terms governing your use of Bower ## Your responsibilities * Do not store credentials, passwords, or access tokens in notes. * Use workspace roles to control who can access your data. * Review the [audit logs](/trust-centre/audit-logs) periodically if your workspace handles sensitive research data. * Use a strong, unique password for your Bower account.