Data handling
How Conveyor handles your data
Backup software sees a lot, so here is the short version. Your files are encrypted on your own computers. Conveyor’s servers keep records about backups, not what is in them. The AI is told even less, and you control how much.
What leaves your devices
The backup agent on each computer sends two things.
- Your backups, encrypted on the computer before they are uploaded to your backup storage. The keys stay with you (or your organization’s escrow key), not with us.
- Statistics about each run, sent to Conveyor so you can see that backups work: how long a run took, how many files and bytes it covered, how many errors of each kind, and how much was uploaded.
The statistics never include file contents.
What Conveyor places on your devices
To detect ransomware, the agent places a small number of verification files in every folder it protects.
- Where they are: in a folder named Conveyor Backup Verification inside each protected folder, its first subfolder and its most recently used document folder, with a README that explains them, plus one document directly in each protected folder. At most 20 files per computer, a few hundred kilobytes each. They are not hidden.
- What they contain: ordinary-looking documents and pictures with meaningless, generated content. They contain no customer data, no macros and no programs, and nobody but the agent on that computer ever reads them. Their names and contents never leave the computer; Conveyor’s servers receive only counts.
- What they are for: ransomware changes or renames files without asking. The agent checks these files at every backup; if they change, it pins your last clean backup, keeps backing up into a quarantined lane and alerts your administrator. Only a person can clear that alert.
- They are always on. No setting, remote command or AI can remove them from a device. An organization admin can exclude named folders where writing is impossible or forbidden; the exclusion waits seven days and stays visible on the device’s page. Please do not delete or edit them: one deleted by accident is put back at the next backup.
What Conveyor’s servers hold
The control plane, the website and service you manage backups from, holds metadata: your organizations, people, devices, settings, alerts and the statistics above. It does not hold your files or the keys that open them.
When you browse a device’s backups to find a file, the list of file names comes from the device on request and is deleted from our servers after 10 minutes.
Every backup also publishes a small signed list of the storage pieces that belong to it, so a second backup box can copy it without ever opening it. Beyond what any storage service already sees (the names, sizes and times of the pieces), that list shows which pieces belong to which backup, and so roughly how much changed between two backups, plus a file count and a total size. It contains no file names and no file contents, and the control plane keeps only its summary, never the list.
Web restores
A restore you download from the browser is encrypted on your device with a key that exists only in your browser; our servers and storage hold ciphertext, cannot open it, and delete it when the link expires. Conveyor staff working inside your organization (a support session you granted, or emergency access) cannot create such a download at all; they can only restore to a folder on your device. To help choose what to restore they can see the names, sizes and dates of backed-up files and folders, never their contents.
One thing to know: when a device is revoked, the temporary storage credentials it already holds stay valid for up to one hour. They only reach that device’s own backups, and they stop working at the end of the hour.
The AI
Conveyor includes an AI that watches backups, explains what went wrong and, if you allow it, fixes safe things for you. It is included in the price, and you decide how much it does and what it sees.
How much the AI does on its own
Five levels. You choose one for each organization, and the AI never goes beyond it.
-
Manual
Nothing. Alerts and health scores come from fixed rules only.
You do everything.
-
L1 Assist
Watches every backup, explains failures and odd changes in plain English, and writes digests and reports. Takes no action.
You act on every finding.
-
L2 Recommend
Prepares the fix with a preview, the exact steps and an undo. You apply it with one click. This is where every new organization starts.
You approve each action.
-
L3 Conditional autonomy
Carries out safe, reversible actions itself, such as retrying a backup or extending retention, and tells you. Asks first when something is new or touches many devices.
You review the log.
-
L4 Full autonomy within guardrails
Everything in L3, plus device-level schedule and throttle changes that undo themselves if the next backup is worse. Switched on per organization, never by default.
You sign off on anything destructive or irreversible.
What is sent to the model
Only metadata about your backups, never file contents. Each organization can turn each item below on or off. These are the starting points; organizations that Conveyor marks as regulated start stricter.
| Information | New organization | Regulated organization | Example |
|---|---|---|---|
| Device namesSo the AI can tell you which computer failed. | Shared | Shared | ACCT-LAPTOP-04 |
| User namesSo it can say whose backup is affected. | Shared | Shared | m.alvarez |
| File and folder pathsErrors and restore requests name the file. Without paths the AI knows that a file failed, not which one. | Shared | Not shared | C:\Users\m.alvarez\Documents\Q3-budget.xlsx |
| Error messagesThe text of what went wrong, as the backup agent reported it. | Shared | Shared | access denied: file is locked by another process |
| IP addressesRarely needed. Off unless you turn it on. This is about your addresses, those of your devices and networks. The address of Conveyor's own gateway, the service your devices connect to, is ours, not yours, and may be sent as it is. | Not shared | Not shared | 203.0.113.24 |
| File contentsNever leave your devices for the AI. The backup agent does not send them to us, and the AI never sees them. | Never sent | Never sent | — |
“Not shared” means the item is left out, or for names and addresses replaced by a code such as device #a3f1 so the AI can still tell one from another. Organizations can also keep sharing paths but replace each one with a code. Every request is logged with exactly which items it carried.
Where it goes and how long it is kept
- Requests go to Anthropic's Claude API under Anthropic's commercial terms. Those terms do not allow Anthropic to train its models on your data.
- By default Anthropic deletes API inputs and outputs within 30 days. Anthropic's published policy retains content its automated safety systems flag for longer; that policy, not this page, states the terms. The short daily overview in your digest is requested through Anthropic's Message Batches, which keep inputs and outputs for up to 29 days.
- Conveyor logs the attribute set of every request, which attributes were shared, replaced or left out. It also keeps a record of each AI run for 90 days, what the AI was shown after the rules above were applied, what it answered and what it did, so that you and we can check its work; after 90 days only the cost and the outcome remain. It never logs file contents, because it never has them.
What the AI can never do
At every level, a person must do these. The AI has no way to do them, and the app refuses if it tries.
- Give Conveyor staff access to an organization
- End a support session
- Create an API token or connect an app
- Revoke an API token
- Release a retention hold early
- Move existing backups to a new recovery key
- Tell a backup box to carry on without a recovery point it lost
- End a backup box's containment after it lost its own record of one
- Make another backup box the place a computer backs up to
- Remove a copy of a backup from a destination device
- Add a place where backups are stored
- Lock how long a backup box keeps deleted data, for good
- Change or switch off a place where backups are stored
- Clear a ransomware alarm on a device
- Release the clean backups pinned after a ransomware alarm
- Resume backups that were paused after a ransomware alarm
- Remove a device from your backups
- Cancel an enrollment link
- Create or change your organization's recovery key
- Retire a recovery key
- Accept an invitation on someone's behalf
- Place a legal hold on a backup
- Release a legal hold on a backup
- Turn on ransomware alerts before the learning period ends
- Change an organization's regulated status
- Switch the AI off or on for everyone
- Choose which AI model Conveyor uses
- Restore files over the originals
- Clear the suspect mark of backups
- Take the protection off a backup (after a 7-day wait)
- Let Conveyor support into your organization for a limited time
- Remove a person's access and sign them out
- Replace a webhook signing secret
- Shorten how long backups are kept, or delete backups
- Turn off immutability or rotate keys
- Approve scripts that run on your devices
How to turn it down or off
- Your organization: an org admin can lower the AI’s level, or switch it off, from the AI page. It takes effect at once and needs no code. Raising it again takes an org admin and a confirmation code.
- What it sees: org admins switch each item above on or off in AI settings. Changes are reviewed and published like any other setting, and the history is kept.
- Everyone at once: Conveyor has a switch that turns the AI off for every organization. Org admins are emailed when it is used.