Compliance & Audit

Audit trail

Every operation in MarcoPolo is visible and traceable.

Conversation history captures every tool call, query, and command your AI executes. You can see exactly what SQL was run, what files were accessed, and what results were returned.

Workspace artifacts are saved to your filesystem, providing a persistent record of work done. You can browse these like your own computer: queries/ holds every query written, downloads/ holds files pulled from data sources, and scripts, analysis outputs, and generated files are all preserved.

Data source access logs track which sources were queried, when, and by which user.

There are no background operations. Your AI doesn't access systems or run queries outside of what you see in the conversation.

Data handling

No data replication. MarcoPolo operates as a passthrough layer. Queries execute directly against your data sources. Results are cached in your workspace (DuckDB) for session-level iteration, but your source data is never replicated, warehoused, or centralized by MarcoPolo.

No training. Your data, queries, and workspace contents are never used for AI model training. This applies to all data that flows through MarcoPolo.

Workspace persistence. Your workspace files persist across sessions: cached query results, generated scripts, and artifacts. Source data stays in your systems. What persists is the work product, not the underlying data.

Data residency

MarcoPolo workspaces run on cloud infrastructure. For enterprise customers with specific data residency requirements, contact support@marcopolo.dev to discuss deployment options: regional workspace deployment, VPC peering and PrivateLink, or Bring Your Own Cloud (BYOC).

Common questions

Can the AI or MarcoPolo see my data? The AI only sees query results you explicitly request. It has no background access to your systems. MarcoPolo infrastructure does not access your workspace contents.

Is my data used for AI training? No. Customer data never enters any training pipeline.

Can MarcoPolo employees access my workspace? Access to customer workspaces is restricted to authorized support operations with audit logging.

What happens if I delete a data source? The connection is removed. Cached results from previous queries may still exist in your workspace's DuckDB, but no new queries can be made against the removed source.

Download the security brief (PDF)

For compliance documentation or security questions, contact support@marcopolo.dev.