{
  "title": "Security and privacy",
  "description": "Compare retention, training use, residency, encryption, secrets, local-only operation, policy, and auditability independently.",
  "slug": "data-security-controls",
  "locale": "en",
  "seoTitle": "Security and privacy feature coverage — Can My Agent Use",
  "socialTitle": "Security and privacy feature coverage",
  "socialDescription": "Compare retention, training, residency, encryption, secrets, local-only operation, policy, and audit controls.",
  "llmSummary": "Security and privacy is an internal catalog grouping for retention, training-data use, data residency, key management, secrets, offline operation, organization policy, and audit logs.",
  "audience": "Security, privacy, compliance, platform, and procurement teams.",
  "contentKind": "feature",
  "status": "published",
  "tags": [
    "security",
    "privacy",
    "governance",
    "enterprise"
  ],
  "updated": "2026-08-28T00:00:00.000Z",
  "published": "2026-08-28T00:00:00.000Z",
  "category": "security-privacy",
  "summary": "Group common security, privacy, and organization-control questions.",
  "specLabel": "Catalog grouping",
  "aliases": [
    "enterprise controls",
    "data governance",
    "privacy controls",
    "security controls"
  ],
  "capabilityKind": "family",
  "related": [],
  "relations": [],
  "highlight": true,
  "notes": [],
  "issues": [],
  "resources": [
    {
      "title": "Methodology",
      "href": "/methodology",
      "kind": "note"
    }
  ],
  "support": [],
  "html": "/features/data-security-controls",
  "markdown": "/features/data-security-controls.md",
  "json": "/api/v1/features/data-security-controls.json",
  "body": "Provider-level security pages are not automatically harness-level evidence. A useful record follows prompts, uploaded files, repository content, retrieved data, tool results, generated artifacts, telemetry, feedback, abuse-monitoring copies, and backups through the exact web, desktop, editor, or CLI execution path.\n\nEach child row keeps plan, organization setting, region, account type, connector, model endpoint, local or hosted execution, and review date attached. “Enterprise ready” and a list of compliance certifications are not substitutes for operational controls an evaluator can verify."
}