docs/additional-documents/DATA-FLOW.md

Data Flow & Data Minimization

This document describes where data lives and moves in a mona-agent deployment, for GDPR/DPIA reviews and security assessments.

Data inventory

Data	Created at	Stored at	Retention
User account	Cloud (Sngine)	Cloud DB	Until account deletion
Device token	Cloud, on request	Cloud DB (plain, revocable) + device config	Until revoked
Provider API keys	User input (dashboard)	Cloud DB, AES-256-GCM encrypted	Until deleted
Chat messages	Dashboard / device	Cloud DB	Per-user; delete per agent or factory reset
Run traces (reasoning, tool calls, results)	Device loop	Cloud DB (runs + steps)	Deleted with agent / factory reset
Usage & cost metrics	Every LLM call	Cloud DB	Aggregated for insights; per-run detail deleted with agent
Device telemetry (CPU/mem/disk/uptime)	Device, every 10 s	Cloud DB (latest + rolling history)	Forgotten on "Forget device"
Device files & command output	Device tools	Stays on the device except task-relevant results streamed to the cloud for the brain	Ephemeral per run

Data flow (one task)

1. User sends a message (dashboard → cloud over TLS).
2. Cloud queues the task; the device polls and claims it (outbound HTTPS).
3. Device sends context to the cloud brain; the cloud calls the LLM provider using the user's key (decrypted in memory only).
4. Brain decides tool calls; the device executes them locally and returns results to the cloud.
5. The cloud stores the conversation, the run trace and usage metrics; the dashboard streams the answer to the user.

Minimization principles

• No secrets on devices. Provider keys never leave the cloud.
• No model weights anywhere in this product. The product is a control plane; the models are third-party APIs.
• Telemetry is performance-only (CPU, memory, disk, uptime, load). No keystrokes, no screen capture, no browsing history.
• Tool output is truncated for transport (bounded context) — the full output stays on the device unless the task requires it.

Data subject rights (operator toolkit)

• Export: per-user training export (JSONL) and audit log access.
• Delete: per-agent deletion, per-user factory reset, device telemetry forget, token revocation — all available in the dashboard.
• Minimize: free plan limits bound data volume per account.