How isolation actually works.
We'd rather show you the mechanism than wave a badge. This page describes how sys9 isolates secrets, data, and identity at the architecture level — the parts you can reason about and verify, not a logo wall.
Know the boundary you are configuring.
Managed network secrets
run9 can substitute configured secret placeholders in HTTPS request headers at managed egress. This requires managed network mode and rules for the allowed host and header; the default network mode is normal. This control does not cover secrets you put directly in files or environment variables.
run9Per-agent vault grants
drive9 provides workspace credentials and vault grants that you configure for an agent. Credential retrieval, environment injection and vault mounting have different exposure boundaries. Choose scoped access for the intended operation and treat any process receiving a credential as trusted to use it.
drive9Database and application boundaries
db9 supports separate databases and branches for different tasks or tenants. Your application must still authorize each user, select the correct database and protect its credentials. A branch or a separate filesystem does not establish your application’s tenant authorization policy on its own.
db9 →Private spaces require a secret
owl9, inbox9 and tape9 can create open spaces when first used without a secret. For private data, choose your own unique space and configure its secret before the first request that creates it. Adding a secret later does not secure an existing open space. Share the secret only with authorized clients.
Follow the service setup guide →Plan access, export and retention.
Agent state shouldn't be a black box. The stack is built so humans stay in control of the data their agents produce.
Inspectable
mem9 lets humans inspect, import, and export agent memory. owl9 transcripts are human-readable, so a run is auditable after the fact.
Portable
db9 and drive9 are yours to read, copy, and mount locally. No proprietary lock-in on the data plane — standard Postgres and a real filesystem.
Configured access
Review each service’s credentials and defaults. Use the narrowest available grants, configure private spaces before sending data, and enforce tenant authorization in your application.
Stored data has a lifecycle.
Compute suspension and data retention are separate. Keep an independent copy of data you need beyond the service’s retention window.
| Service / data | Retention boundary | What to do |
|---|---|---|
| chord9 artifacts | Normally retained for one year after delivery. They may expire 30 days after their session is archived or their Host is unlinked. | Download artifacts you need to retain before expiry. |
| chord9 images and archived content | Prompt images are ordinarily retained for 90 days; archived content for 30 days. | Review Settings > Storage and retain your own required copies. |
| owl9 / tape9 | Transcript and log retention can trim stored history. tape9 applies a configured byte budget and retention mode. | Confirm deployment limits and export required records before trimming. |
| inbox9 | Messages expire under the service’s retention configuration, including messages that have not been read or marked. | Process messages within that window; store durable business records separately. |
| drive9 evaluation | Anonymous workspaces are for evaluation, not a long-term data retention commitment. | Review the production storage and security guidance. |
| Other service data and backups | Retention, export and deletion depend on the product and deployment agreement. | Contact us to confirm the requirements for your data before production use. |
Found something? Tell us.
If you believe you've found a security issue, email x@db9.ai with
steps to reproduce and the affected service. Please avoid including live credentials or
other users’ data. We can coordinate follow-up through that address.