Your context. Clear boundaries.

Orben uses Azure-hosted AI on Anubion’s Microsoft Azure model resource, authenticated with Anubion’s application identity. Some requests do not require a model call. When needed, the model receives the question, bounded recent history, relevant derived memories, selected authorized evidence and registered tool definitions/results. The full Azure estate is not supplied as model context. Passwords and Azure client secrets use a separate secure form; they are not supplied to the model. Microsoft safety filtering and service abuse monitoring may apply; these are separate from model training and Anubion’s conversation storage.

Relevant derived summaries may be included in a model call. Anubion stores these separately, scoped to the organization and conversation owner, with a default 90-day expiry. Memory helps retain context; it is not a substitute for current evidence.

Anubion stores questions, replies and conversation history in its application database so you can continue a thread and a reply can finish after you leave the page. A model being stateless does not make Orben conversations ephemeral. Conversation storage follows the retention policy below.

Each new message extends the conversation’s configurable inactivity expiry (default 30 days). Expired conversations are hard-deleted by a daily job. Derived memories default to 90 days. Backups and operational logs can retain related records until those stores expire. Users can delete a conversation and its sourced memories earlier. Account erasure and data-subject requests are handled through support@anubion.io.

Anubion hosts the application and conversation database in Denmark East. Production Orben inference uses Data Zone Standard, billed per token, within the EU Data Zone; the Azure AI resource is in Sweden Central (not a global AI deployment for production Orben). Operational telemetry is in West Europe. Microsoft’s documented operational EU Data Boundary exceptions (for example support and security operations) are disclosed separately and are not an absolute promise that Microsoft never performs a contractually covered transfer. Resource data stored at rest remains in its designated Azure geography. Microsoft’s data processing details.

Ordinary customer isolation applies between organizations. Privileged Anubion administration is a separate operational path described in a security review.

Public web and API traffic uses TLS. Anubion’s database and storage use Azure encryption at rest. Stored integration credentials are encrypted and are not returned in plaintext through the API.

The model reasons about intent and can propose only registered Anubion operations. The application resolves organization scope and rechecks your current permissions when an action executes. Application policy requires confirmation for destructive or high-impact actions; confirmation expires and is bound to the requesting user. Anubion operations/APIs perform controlled execution and record action outcomes. The model has no arbitrary database or API authority and cannot elevate permissions. Sensitive values use a separate secure form and are redacted from action-step records. Orben operates inside Anubion, such as tasks, scans and organization settings, and has no unrestricted Azure resource mutation authority.

Orben operational telemetry is designed to record metadata, such as operation, token counts and tool names, not prompt or reply content. Conversation content is persisted separately under the retention policy. Action audit records are a separate record of activity. Microsoft service monitoring may still apply to model processing.

Live customer turns do not run a separate evaluator or judge loop. Evaluation is release/testing tooling. Production uses an approved configuration; experimental prompt optimization and automatic promotion from customer conversations are not part of the live request path.

Anubion does not use Orben conversations to train foundation models. Microsoft states that prompts and completions are not used to train or improve foundation models without permission or instruction. This is a training commitment, not a promise of zero retention: Microsoft safety/service monitoring and Anubion conversation storage are separate. Microsoft’s data privacy policy.

Ordinary customer access is restricted to the authenticated identity and authorized organization. Anubion resolves membership and the organization’s tenant association, scopes retrieval and rechecks permissions for actions. If the tenant cannot be uniquely bound to an organization, Orben refuses the request. The model does not choose organization scope. Privileged Anubion administration follows the separate operational path described above.

AI transfer applies only when a model call is needed. Previous responses may be included as bounded history in a later call.