# Privacy — a database of customers you didn't set out to keep | AltairaLabs > Callers are pseudonymised before anything is written; identifiers in the transcript, the tool call and the memory are stripped as they’re stored; consent and erasure reach what was already kept, with an audit trail. Canonical page: https://www.altairalabs.ai/privacy/ Privacy # You didn’t set out to build a database of customers. An agent writes down everything it’s told. The transcript, the tool call that carried a policy number, the answer that came back, and a memory that outlives the session: six places the same person lands, and none of them was a decision. A subject access request reaches every one. enterprise Free in your cluster while you build. An agreement when it carries real traffic. [See exactly where the line falls →](https://www.altairalabs.ai/open-source) awaiting recording A customer gives their SSN to verify themselves. The agent verifies them, and neither the stored transcript nor the memory written afterwards keeps a copy of it. videos/redaction.mp4 the same conversation, as it comes to rest ## Three people are in every conversation. 01 · the caller Nobody in Omnia is a name. The person on the line becomes a pseudonym before anything is written, and the key back to them stays in your identity provider. A session, a memory and an audit row all carry the pseudonym. 02 · the person being discussed A pseudonym covers the handler, and says nothing about the customer they’re asking after. Her policy number and card number land in the transcript, so they’re stripped as the record is written. A field in a tool response goes further and is replaced before the model reads it. 03 · what it remembers The same check runs before anything is committed to long-term memory, which outlives the session that was supposed to govern it. A summary that would carry an identifier into next month is refused outright. ## Replace, hash, or mask. Pick per field. Replace gives you a marker. Hash keeps a value joinable but unreadable, so analytics still work. Mask keeps the last four, for the person who has to check it against something. Encryption is independent of all three, and keys rotate. The patterns are structural: national insurance and social security numbers, cards, phone numbers, email addresses, IP addresses, and any regex you add. A name in free text isn’t a pattern and won’t be caught. What you get is that no identifier comes to rest, and what’s left is a set you can list. ## When someone asks to be forgotten. Erasure is keyed by the pseudonym and reaches every service group in the workspace: the sessions, their media, and the memories. Each one is recorded, so a target that failed is named and a reviewer can read what happened. Consent is per person and per category, and withdrawing it reaches what was already stored. memory ## Memory is the hard one. A transcript has a session around it. A memory doesn’t: it carries into next month and the month after, and a consolidation pass writes summaries that no longer point at where they came from. Memory is stripped on the way in, classified by what it reveals, and gated by the person’s consent for that category. Revoking it reaches back. [Try it on your own data](https://omnia.altairalabs.ai) [Talk to us →](https://calendly.com/altairalabs-ai/altairalabs-how-can-i-help) the tour 5 of 8 1. [Platform](https://www.altairalabs.ai/platform) 2. [The console](https://www.altairalabs.ai/console) 3. [Run anywhere](https://www.altairalabs.ai/run-anywhere) 4. [Governance](https://www.altairalabs.ai/governance) 5. Privacy 6. [Memory](https://www.altairalabs.ai/memory) 7. [Assurance](https://www.altairalabs.ai/assurance) 8. [At scale](https://www.altairalabs.ai/scale) [Governance](https://www.altairalabs.ai/governance) [Memory: four tiers, and which one wins](https://www.altairalabs.ai/memory)