> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Handling

> What the Ankra control plane stores, what never leaves your cluster, and how secrets move through their lifecycle.

Ankra's control plane stores the minimum it needs to operate your fleet, and is explicit about what stays inside your cluster. This page describes both sides of that line.

***

## What the control plane stores

| Data               | Notes                                                                                                              |
| ------------------ | ------------------------------------------------------------------------------------------------------------------ |
| Cluster metadata   | Names, providers, regions, node inventory, and [cluster states](/concepts/cluster-states)                          |
| Workload inventory | The Kubernetes resource data the agent streams for display - Deployments, Pods, Services, and other resource types |
| Credentials        | Cloud, Git, and registry credentials, stored encrypted in Vault or OpenBao                                         |
| Audit events       | The append-only [audit log](/guides/audit-log) of administrative changes                                           |
| Chat transcripts   | AI Assistant conversations, persisted only after always-on secret redaction                                        |

***

## What never leaves your cluster

* **Container images and scan targets** - Trivy Operator runs in-cluster and Ankra reads only findings metadata (CVE identifiers, severities, affected images and workloads). No image contents leave your cluster. See [Cluster Security](/guides/cluster-security).
* **Secret values** - the AI surface receives secret keys and counts only, never values, and tools that return configuration redact secret fields.
* **SOPS plaintext** - values encrypted with [SOPS](/guides/sops) are decrypted inside your cluster at deploy time. The control plane and your Git repository hold only ciphertext.

***

## Secret lifecycle

Platform credentials are written straight into Vault-backed storage on creation, decrypted only when a provisioning or deployment action needs them, and deleted when you remove the credential. For Git-stored values, each organisation gets its own SOPS/AGE key pair: the public key encrypts values in the Stack Builder and CLI, the private key stays in Ankra's vault and is delivered only to clusters that decrypt. Keys can be [rotated](/guides/sops#key-rotation), and per-cluster SSH keys are likewise generated and held in Vault rather than in cluster definitions - see [Cluster Hardening](/security/hardening).

***

## Sub-processors

The current list of sub-processors and hosting providers is published at [ankra.ai/trust](https://ankra.ai/trust).

***

## Data deletion

When an organisation is offboarded, its stored data - cluster metadata, workload inventory, credentials, audit events, and chat transcripts - is removed from the control plane.