YOUR DATA.
THE FULL RECORD.
What the Raqio desk stores, who can access it, and what stays on-chain. A factual description of the software.
PRIV_001 · Rev 2026.09
Privacy notice
What this software stores. This notice describes the data the Raqio desk stores when you use it, and what it writes to Elysium. It is a factual description of the software, not legal advice, and the organisation operating an instance is responsible for its own policies.
Stored data
- ·Account: name, email, a scrypt password hash, session tokens (hashed), and any wallet address linked by signature.
- ·Organisation settings, including the desk contract addresses and the funding wallet address.
- ·Operations: kind, name, reference, the original pasted or uploaded CSV, every leg (label, address, asset, amount, not-before, memo), validation results.
- ·Plans: the committed Merkle root, its salts and the unrevealed legs behind it, so an operator can reveal and execute them later.
- ·Routes and fee quotes returned by the route provider for cross-chain legs, including raw responses for audit.
- ·Approvals, funding records, execution attempts, transaction hashes, reconciliation notes.
- ·Audit events: who did what and when.
Who can access it
- ·Members of your organisation according to their role (Viewers see redacted addresses).
- ·Anyone operating the server and database.
- ·In real mode, Elysium and anyone reading it: the desk contract address, recipient addresses, amounts, timing and contract events. The owning wallet is not the destination; it is the funder of the contract.
- ·For cross-chain legs, the route provider receives the funding wallet address, the desk address and amounts for quoting and execution.
What is not done
- ·No analytics or tracking scripts are included.
- ·Data is not sold or shared with third parties beyond the chain itself and, for cross-chain legs, the route provider.
- ·Unrevealed plan legs are not published anywhere until an operator executes them.
- ·Raqio does not verify recipients for Tokens with transfer restrictions and does not hold private keys.
Retention
- ·Records are kept until deleted by an organisation owner or the operator.
- ·Audit events are append-only by application design.
- ·What has been written to Elysium cannot be deleted by anyone.
Protection and retention
| Record | At rest | Lives |
|---|---|---|
| Labels, memos, CSV originals | ENCRYPTED AT REST | Until deleted by an owner or operator |
| Passwords | SCRYPT HASH | Never stored in clear |
| Session tokens | HASHED | Until sign-out or expiry |
| Unrevealed plan legs | SALTED · NOT PUBLISHED | Until executed or the plan is cancelled |
| Audit events | APPEND-ONLY | Never edited, never deleted by the app |
| Writes to Elysium | PUBLIC · PERMANENT | Cannot be deleted by anyone |
Colophon
- Sheet
- PRIV_001 · Rev 2026.09
- Applies to
- This software as built. It changes when the software does.
- Source
- docs/security/privacy-threat-model.md in the repository
- Contact
- The organisation operating this instance