Last updated 28 June 2026.
Elliptic is open source and self-hostable. This policy explains how data is handled when you run your own instance, and what the hosted instance at elliptic.sh collects. The Elliptic software is licensed under Apache-2.0.
Self-hosted deployments
When you run Elliptic on your own infrastructure, everything you create stays in your own Postgres database on your own servers. Projects, tasks, meetings, notes, files, and model keys never reach us. You are the data controller, and this page is a reference for your own users rather than a contract with us.
What the hosted instance collects
- Your name, email, and organization membership.
- The work you create, from projects and tasks to meetings, notes, and comments, and the activity and audit events they generate.
- The session cookies and tokens that keep you signed in.
- Request and error logs we keep to run the service reliably.
Your model keys (BYOK)
AI features run on your own OpenAI or Anthropic key. Keys are encrypted at rest with AES-256-GCM under a per-deployment key-encryption key, are never written to logs, and only the last four characters are ever shown back to you. Prompts and completions are sent directly to the provider you configure, under your key, and every AI run is recorded in your own audit log.
Where your data goes
Beyond your own deployment, data only leaves to services you explicitly configure.
- The AI provider whose key you supply (OpenAI or Anthropic), for AI features only.
- Your own S3-compatible object storage, if you enable file uploads.
- Your identity provider, if you enable SSO, SCIM, or LDAP.
Data retention and deletion
Your data is kept while your account and organization are active. Deleting an organization removes its data. To request an export or deletion, reach us through the contact page.
Changes to this policy
We will post any changes on this page and update the date above.
Contact
Questions about privacy or your data go to the contact page. To report a security issue, follow the security policy.