Skip to main content
This page explains in detail how raum handles your data at every stage — from when a Zendesk ticket arrives to when a response is sent. Understanding the data flow helps you assess raum’s security posture and answer questions from your own security or compliance team.

Data flow overview

When a ticket arrives, raum processes it through the following path:
1

Ticket received from Zendesk

Zendesk delivers the ticket to raum via webhook or the Zendesk app. The raw ticket content — subject, body, conversation history, attachments — is received by raum’s processing layer.
2

PII redaction

Before any ticket content is passed to the AI, raum’s redaction pipeline scans the text and replaces personally identifiable information with typed placeholders. The original values are held in memory only for the duration of the request.
3

AI processing

The redacted ticket content is sent to your AI provider (OpenAI, Anthropic, or Gemini) using your own API key. raum’s AI accounts are never involved. The AI receives only the redacted text.
4

Response construction

The AI returns a response. raum restores the redacted values where the AI has referenced them by placeholder, producing a natural reply with the correct customer details.
5

Action and logging

The response is posted to Zendesk. The action is logged in raum’s audit trail with timestamp, IP address, and operation type. PII in the ticket content is masked in the log entry.

PII redaction pipeline

raum’s redaction runs on every ticket before AI processing. It uses pattern matching to identify common PII types and replaces each occurrence with a consistent typed placeholder.
Data typePlaceholder
Full name[REDACTED_NAME]
Email address[REDACTED_EMAIL]
Phone number[REDACTED_PHONE]
Credit card number[REDACTED_CC]
The AI works with placeholders throughout its reasoning. When the AI references a placeholder in its reply (for example, addressing the customer by name), raum substitutes the original value back in before the response is posted to Zendesk. Redaction also applies to audit logs. Log entries that include ticket content store the redacted version — personal information does not appear in plain text in raum’s logs.
Redaction happens in memory on raum’s servers. The original PII values are never written to disk or stored in any database during processing. They exist only in the memory of the request handler for the duration of the pipeline execution.

What gets stored vs. what’s ephemeral

DataStoredEphemeral
Ticket content (raw PII)NoHeld in memory during request only
Ticket content (redacted)Yes, in audit logs
AI responsesYes, for analytics and response cache
API keys and credentialsYes, encrypted at rest
Token usage and cost metricsYes, for dashboard analytics
Session tokens (JWT)NoExpire per session
Analytics data (token usage, cost, resolution times, CSAT) is stored for the duration your account is active. Ticket content in audit logs is retained for 90 days, after which it is automatically purged.

Encryption details

Field-level encryption for credentials

Your AI provider API keys, Zendesk credentials, and any other secrets you store in raum are encrypted at the field level using AES-256-GCM. Encryption is managed through AWS KMS, which handles key storage, access control, and rotation.
  • Each sensitive field is encrypted individually, not at the row or table level
  • Encryption keys are rotated automatically by AWS KMS on a regular schedule
  • Access to KMS decrypt operations is controlled by IAM policies following least-privilege principles
  • Encryption keys are never stored alongside the data they protect

Data in transit

All data in transit between raum, Zendesk, and your AI provider uses TLS. API calls from the Zendesk app to raum’s backend use Bearer token authentication over HTTPS.

Audit log contents

Every AI operation and administrative action produces an audit log entry. A log entry records:
  • Timestamp: when the action occurred
  • Operation type: for example, generate, translate, rewrite, admin_settings_change, api_key_rotation
  • User or system identity: which user or automated process performed the action
  • Source IP address: the IP of the authenticated requester
  • Change summary: for settings changes, what was changed and from what value to what value
For AI operations, the log records the operation type and ticket identifier, but not the raw ticket content (which is stored in redacted form only).
Admin impersonation is logged with both the admin’s identity and the user being impersonated. This means every action taken under impersonation is fully attributable.

BYOK data sovereignty

When you connect your own AI provider key, your customer data flows directly from raum to your provider — not through any raum-owned AI account. This has important implications for data sovereignty:
  • Your provider’s data policies apply: OpenAI, Anthropic, and Google each have their own data processing terms. When you use your own key, you have a direct relationship with the provider you’ve chosen and can negotiate DPAs or use enterprise plans that meet your compliance requirements.
  • raum never holds a copy of AI-processed content: The AI call goes from raum’s server (with redacted content) to your provider’s API. The response comes back to raum for post-processing and delivery to Zendesk.
  • No AI markup or aggregation: Because you pay your AI provider directly, raum has no commercial incentive to retain or aggregate your AI traffic.
If you have strict data residency requirements, choose an AI provider that offers regional API endpoints and configure your raum connection to use those endpoints. Contact your provider for details on regional data processing.

Data retention

Data typeRetention period
AI-processed ticket data90 days, then automatically purged
Audit logs90 days
Account and configuration dataDuration of subscription + 30 days after termination
Analytics metricsDuration of subscription
After account termination, configuration data and analytics are retained for 30 days to allow for data export. After that period, all data associated with your account is permanently deleted.
Yes. Contact [email protected] to request deletion of your data before the standard retention period. We will respond within 30 days. Enterprise customers can request a Data Processing Agreement (DPA) that formalizes deletion timelines.
raum stores redacted ticket content in audit logs (names, emails, and phone numbers are masked). It stores derived analytics data — resolution times, CSAT scores, token counts — that is not linked to individual customer identities. Raw personally identifiable information is never stored at rest.
raum runs on AWS infrastructure in the United States. Data is processed in real time and is not transferred to additional regions. If you require specific data residency, contact our team to discuss your requirements.