How your data is handled

This page explains where Overwatch Console keeps your data, which companies process it, how long it is kept and how it is removed. It describes the product as it works today.

What stays in your Sentinel workspace

Your security logs stay in your Microsoft Sentinel workspace. Overwatch does not copy the workspace. Agents run KQL queries on demand through the app registrations you created during setup, and you can revoke those registrations in Microsoft Entra ID at any time.

What Overwatch stores

Overwatch stores the results of its own work, separately for each tenant:

Every read, write and model call is limited to your tenant. One tenant's data is never used for another tenant's work.

If your organization is a client of an MSSP (a security provider that works in Overwatch Console for you), the MSSP's people can open your organization and work in it under their own names, and what they do is in your Audit Trail. Your data stays in your tenant. The MSSP's own overview of its clients shows counts only (incidents worked, approvals waiting, data source health, agent runs), never incident or log contents. Your administrators can remove an MSSP person from Settings > Access & roles.

Files Caleb analyses (attachments of reported emails, and files you upload on his page) go to Caleb's private sample store in Overwatch's Azure subscription, kept separately for each tenant. A file is read by static tools in a short-lived isolated container with no internet access, and is never run. Stored files are deleted 30 days after they were last written, and an upload that was never handed to Caleb after 2 days.

The console runs on Railway in the United States (US East). The database runs on Railway in the United States (US West). Traffic to the console, the database, the AI providers and Microsoft is encrypted in transit.

AI processing

To investigate an incident, an agent sends the evidence it needs (incident details and the rows its queries returned) to a large language model. Requests go through OpenRouter to the model provider:

Every request asks OpenRouter for zero data retention: it may only go to a host that does not keep prompts or responses and does not collect them. If a model has no such host, the request is refused rather than sent elsewhere.

Renzo's research step can search the public web through OpenRouter's web search while it reads public threat intelligence. Agents that work with your incident data do not search the web.

Models are not trained on your data by Overwatch, and the providers' API terms exclude training on API traffic.

How long data is kept

Retention is set per tenant. These are the defaults; to change them, ask us. Every change is recorded in the Audit Trail.

Planned: a retention control in Settings.

Investigation records follow the agent log window. Entity history is kept for at least 90 days. Short-lived caches are removed after 7 to 30 days. Cleanup runs once a day.

Removing your data

When you stop using Overwatch, an administrator offboards your organization from Settings > Offboard (Offboard your organization). Agents stop at once, you can download an export, and the console removes the apps, roles and consent it created in your Microsoft directory and every rule it deployed. The export holds your records but not Overwatch's detection logic. Connection secrets, webhooks and keys are deleted when you finish. Your data is then kept for 30 days, or deleted at once if you choose, and after that every record of your organization is deleted and we keep only a deletion record (when, who started it, and how many records were deleted). Until automatic deletion is switched on for all clients, we run the deletion ourselves at the end of the window and confirm when it is done. Deleting data in Overwatch never touches your Sentinel logs.

Companies that process your data

Last reviewed 2026-11-09