api.vaquill.ai) only, not the Vaquill AI chat product. The two are separate systems with separate data handling: chat is built to retain conversation history by design, since that’s the product. The API is not. It exists to serve you statute and regulation text, and it is built to keep as little of your traffic as possible.
The short version: your query text (the query on /statutes/search, or any other request body or parameter) is never written to a database or a log. It exists in memory for the length of the request, and then it’s gone.
What’s stored
Sentry is configured with PII collection off (
send_default_pii=False) for this API, so error reports don’t carry request bodies, headers, or query strings by default.Why webhook secrets and delivery status are the exception
Two things in that table look like they hold onto more than “nothing”: your webhook secret, and the status of each delivery attempt. Both are necessary to the feature itself, not incidental collection. The webhook secret is what lets Vaquill AI sign each delivery withX-Vaquill-Signature so you can verify it came from us. It’s stored encrypted and is never returned by any endpoint once you set it. See Law Change Alerts for how the signature works.
Delivery attempts (status code, success, a short error string) exist so GET /watches/{watchId}/deliveries can show you your own webhook’s health, the same way a payments provider shows you delivery logs for its webhooks. The delivered payload itself (the actual change data) is never stored there. It’s live and only in the request we sent you.
What we don’t do (yet)
There’s no self-serve control today to set a custom retention window or request early deletion of your account’s records. If your organization needs that (a shorter window, a signed data processing agreement, or deletion on request) for a compliance review or an RFP, email support and we’ll work it out directly. This is worth asking for; enterprise legal-AI buyers increasingly expect it, and we’d rather hear the requirement than have you guess at it.Related
Authentication
How API keys work and how to rotate them.
Law Change Alerts
Webhook signing, delivery history, and what a subscription stores.