METRAXIOM separates public browser-local work, ordinary account data, revocable security credentials, AI-processing payloads, and controlled measurement evidence. Each class has a different release state, retention basis, export path, and deletion authority.
The private workspace is held in the current public-production profile. Its release requires organization-scoped authorization and a verified boundary preventing tenant data from becoming public content merely because a feature can process it.
A future private-workspace deletion or closure flow must expose the governed exports promised for that exact data class before destructive disposition is approved.
Released/finalized evidence, raw observations, frozen calibration manifests, release fingerprints, review/release history, and supersession lineage are not silently rewritten or hard-deleted merely to make history disappear. Corrections use controlled revision, amendment, disposition, or supersession rules.
Customer-connected AI/API credentials are security secrets, not measurement evidence. AI Connections is held. Release requires encrypted tenant-scoped storage, immediate revocation, exclusion from ordinary exports/logs/prompts, and independent destruction that cannot change retained measurement history.
The released support path accepts only the information needed to route or diagnose a request. Passwords, API keys, payment-card data, export-controlled material, and unnecessary controlled evidence are prohibited in ordinary support email.
Released public operations use minimized request and control-state metadata. Source-document bodies, passwords, provider secrets, AI credential ciphertext, and full measurement payloads are outside the permitted default logging contract.
Public Builder editing remains browser-local until the visitor deliberately invokes a server-backed public tool. Proof Mode sends bounded measurement inputs and the declared public decision rule to the METRAXIOM server for deterministic computation. Public PDF export sends the selected browser-local worksheet snapshot and notation choice to the METRAXIOM server for rendering. Context Twin sends opt-in latitude/longitude to the METRAXIOM server for rate-limited NOAA/NWS lookup; opening its live space-weather panel requests NOAA/SWPC products through the server without sending worksheet data. World Context Stamp combines those exact provider classes in ephemeral browser-session memory. Server processing does not by itself convert any request into retained controlled measurement evidence, auto-copy context into a worksheet, or enable candidate geocoding/model providers.
Ask METRAXIOM, Interrogate, Reference Intelligence, AI Connections, and external AI clients are separately gated. Source text is untrusted data, task payloads should be minimized, and external AI does not receive measurement authority merely because it can explain evidence.
Founder branding, candidate record marks, and future released verification marks have distinct data meaning. A fingerprint/verification payload identifies a retained record state; it does not convert the mark into accreditation, scientific validation, or third-party approval.
The current public route opens a sanitized privacy request through the published contact channel; it does not execute deletion. Any future account or workspace action must verify the requester, organization authority, exact data class, billing and ownership state, credential/connection scope, retention commitments, legal preservation, and controlled-evidence obligations before changing data.