Warden is an enterprise AI agent studio. Users build agents, connect the agents to their own accounts (email, files, calendars, code, tickets), and talk to them. Every action an agent takes is governed and recorded. This page says plainly what data the studio handles in order to do that, where it goes, how long it stays, and how to remove it. It is written for the users of this studio and for the providers (Google among them) whose accounts users connect.
This studio is operated by its admin, reachable at francis@piotnetworks.com. The software is Warden, open source at github.com/francis4531/warden. Each installation is separate: data in this studio is held only by this studio's admin, not by the Warden project.
| Data | Why | Where it is kept |
|---|---|---|
| Your sign-in | Your email address (from Google sign-in or a studio password) identifies you, decides whether you may enter, and marks everything you create as yours. | In the studio's database, as the owner field on your agents, conversations and connections. |
| Agents you build | The name, instructions, chosen tools and policies of each agent, so it can run. | Database. |
| Files you attach | PDFs, documents, spreadsheets, slides, images and text files you add to a message, so the agent can read them. Nothing is read from your computer except what you pick. | Stored with the conversation in the database (up to 5 files of 10 MB per message) until you delete the agent, and sent to the model provider so it can read them. |
| Conversations | What you ask an agent or in a quick chat, what it answers, and every tool call and result along the way, so you can read back what happened and approve or decline what it wants to do. | Database. |
| Connection tokens | When you connect an account (Google, GitHub, Atlassian, any MCP server), the studio stores the OAuth token that provider issued so your agents can act on your behalf. Admin-entered tokens are never shared with users; each connection belongs to one user. | Database, encrypted at rest with a key the admin holds outside the database. |
| Audit log | A hash-chained record of every step an agent took, every approval, denial and declined request, and every change to policies and connections. It is tamper-evident on purpose and outlives the agent. | Database. |
| Usage and cost | Model tokens used per conversation and the spend they imply, to enforce budgets and caps. | Database. |
| Session cookie | One cookie keeps you signed in. It is HttpOnly, SameSite, and sent only over HTTPS. There are no advertising or analytics cookies. | Your browser. |
If you connect Gmail, Google Drive, Docs, Sheets or Calendar, the studio asks Google only for the scopes the connection you chose needs: read-only by default (gmail.readonly, drive.readonly, calendar.readonly, documents.readonly, spreadsheets.readonly), and the matching write scope only if you explicitly choose a write connection. The consent screen lists exactly what is requested each time.
Google data is used for one purpose: to carry out the tasks you give your own agents. An agent reads your mail, files or events only when a conversation you started calls for it, each read is a tool call you can see in the conversation and in the audit log, and anything beyond a read pauses for your approval before it happens. Google data is never used for advertising, never sold, never used to train models, and never shown to the studio's admin or to other users. Admins can see that a connection exists and what tools it exposes; they cannot use it.
The studio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The model provider. To answer you, the studio sends the conversation, the agent's instructions, and the results of tool calls (which can include content from your connected accounts, such as the text of an email an agent read) to Anthropic's API, which generates the agent's replies. Anthropic's handling of API data is described in its privacy policy; by default API inputs are not used to train Anthropic's models.
The providers you connect. When an agent uses a tool, the request goes to that provider (Google, GitHub, Atlassian, or the MCP server you connected) with your token. Nothing goes to a provider you have not connected.
Telemetry, if the admin turns it on. The admin can export traces of agent runs to their own observability service (OpenTelemetry to Datadog, Grafana or similar). Tool names, risk tiers, outcomes and latency are exported; request and result contents are not exported unless the admin explicitly enables payload tracing, and even then known sensitive fields (tokens, keys, email addresses, card numbers) are redacted first.
A visit counter. The public pages of this studio send the page address and a timestamp to the admin's own visit counter so the admin can see how many visits the studio gets. No cookie, no identity, and nothing from inside your conversations is sent.
No other third party receives data. Nothing is shared for advertising.
Connection tokens are kept until you disconnect. Disconnecting deletes the studio's copy immediately and, for Google, also asks Google to revoke the token so it stops working everywhere. You can additionally remove the studio at any time from your Google account permissions.
Agents, conversations and usage records are kept until you delete the agent, which removes its conversations, pending approvals and eval suites. The audit log is kept: it records what was done, not the contents of your accounts, and its purpose is to remain after everything else is gone.
The admin may delete a user's data entirely on request at francis@piotnetworks.com.
Tokens are encrypted at rest. Sessions are signed with a secret that exists only in the studio's server environment. Every form and request is protected against cross-site forgery. Spawned connection processes receive only the token for that one connection, never the studio's own secrets. The audit log is hash-chained with a keyed signature so edits are detectable. Only a listed admin can see across users, and admin oversight is read-only: an admin cannot run a user's agent, use a user's connection, or approve on a user's behalf.
When this page changes, the date at the top changes with it.