Data handling

What Unifuse holds

Data	Source	Notes
Student and applicant records	Your SIS, LMS and CRM, through the connectors you configure	Read-only copies. Unifuse never writes to these systems unless you list writable fields.
Staff accounts	Your identity provider	Name, email, department, role.
Knowledge-base content	The document sources you connect and files you upload	Tagged with the sensitivity you set per source.
Unifuse’s own records	Created by your staff and the assistant	Notes, tags, escalations, appointments, outreach history, conversations, approvals.
Audit log	Generated	Append-only; never purged.

Redaction

Personal data in conversation records and in what is shown to the assistant is redacted according to the institution’s setting: Full (the default), Partial or Off. See Data policy.

Retention

Conversations and abandoned drafts are purged nightly after the windows the institution sets (by default one year for conversations and 30 days for drafts). Staged rows from nightly imports are kept for 30 days. The audit log is not subject to retention.

Individuals’ requests

Any signed-in user can download the data Unifuse holds about them and request erasure from their profile. Institutions review and carry out erasure requests, with a dry run first and a 30-day due date. See Privacy requests.

When an institution leaves

Unifuse deactivates the institution, which stops sign-ins; exports its audit log on request; then purges all of its data and files after a dry run. Database backups age out after seven days and old file versions after 30, so the data is fully gone within 30 days of the purge. The audit log and a placeholder record of the institution are kept.

Subprocessors

The current list of subprocessors is on the Trust Center.

Related

• Security overview