AI data handling
AI features run on data, so it matters exactly what data that is. This page describes what Firefight stores from your incident channels, the secret redaction that happens before anything is saved, and what leaves Firefight when a model is called. It claims no more than the product does.
What is stored
Section titled “What is stored”To power summaries, catch-ups, and postmortems, Firefight keeps a transcript of each incident channel.
- Messages posted by people in an incident channel, including thread replies, with the author, the timestamp, and the thread structure
- Not messages posted by bots or apps, which are excluded from the transcript
- Only incident channels. Firefight does not record conversation from other channels in your workspace, apart from what you write to Halon itself (see Halon chats)
Message content is encrypted at rest. When someone edits a message in Slack, the stored copy is updated to match. When someone deletes a message, the stored copy is marked deleted and excluded from every AI feature from that point on.
How long it is kept
Section titled “How long it is kept”The transcript is kept for 30 days after an incident ends. Change the number of days under Settings → Workspace, in Keep conversations for, or leave it empty to keep transcripts for good. What the team worked out outlives it, on the incident timeline and in the postmortem. See Incident conversations.
Who can read it
Section titled “Who can read it”Firefight’s own AI features read the transcript to do their work. Nothing else can until an admin turns on Let AI agents read incident conversations, which is off to begin with. Once it is on, members and admins can read transcripts over the API and MCP, and an agent or a service key needs the Incident Transcripts ability granted to it.
Secrets are redacted before storage
Section titled “Secrets are redacted before storage”Every message is scanned for known credential formats before it is saved. Matches are replaced with a placeholder that names the credential type. This happens before anything is saved, so the secret never reaches the transcript or a prompt. Edited messages are scanned again.
The scan covers these formats.
| Category | Redacted formats |
|---|---|
| Cloud and infrastructure | AWS access key IDs, Google API keys, DigitalOcean tokens |
| Code and packages | GitHub tokens, GitHub fine-grained tokens, npm tokens |
| AI providers | OpenAI API keys, Anthropic API keys, Hugging Face tokens |
| Payments and messaging | Stripe API keys, Stripe webhook secrets, Twilio keys, SendGrid keys, Mailgun keys |
| Monitoring and chat | New Relic keys, Slack tokens, Slack webhook addresses |
| Databases | Supabase secret keys, passwords written as password= in connection settings, bcrypt and SCRAM password hashes |
| General | JSON Web Tokens, bearer tokens, PEM private key blocks |
What Halon reads from your connected tools
Section titled “What Halon reads from your connected tools”Halon reads through the tools you connected, acting as the person it works for. Before an answer reaches the model, Firefight takes the secrets out of it.
- A read whose whole answer is a secret is refused, and Halon is told what to read instead. Examples are a Cloudflare tunnel’s token, a value stored in Workers KV or R2, a Neon connection string, a Northflank backup’s download link and the Postgres tables that hold passwords.
- Secret values inside an answer are hidden, and their names kept. Halon sees which environment variables a Northflank service has, but not their values. The same goes for a Turnstile widget’s secret in Cloudflare, an ingest token in Better Stack and a PagerDuty integration key.
- Files that usually hold secrets are left out of code changes. A commit, a compare or a pull request diff names a file such as
.envor a private key, and says its contents are not shown. A shell command Halon runs in a repository cannot name one either. - Every answer is scanned for the credential formats above, wherever they appear.
What is sent to AI models
Section titled “What is sent to AI models”Each feature sends only what it needs.
| Feature | Sent to the model |
|---|---|
| Live summary | The incident’s identifier and name, plus transcript messages. After the first run, only the prior summary and the messages that changed |
| Catch-up | Incident details, timeline events, the narrative summary, actions and follow-ups, and attached runbooks |
| Postmortem generation | Incident details, custom field values, timeline events, the narrative summary, actions and follow-ups, and shoutouts |
| Postmortem section rewrite | The incident context above, the passage you selected, and your instruction |
| Halon chats and investigations | Your question and any files you attach, what Halon’s tools read from Firefight and your connected tools, and the handbook pages, memories and instructions that apply |
| Timeline notes when an incident ends | Transcript messages not read before, the narrative summary and the timeline |
| What Halon learns when an incident ends | The investigations’ findings, any answer the team marked wrong or fix that was undone, the narrative summary, the last 300 transcript messages, and the postmortem once it is completed |
Transcript content in every case is the stored, already-redacted version, and a timeline note someone dismissed is left out. These calls go to the first of your workspace’s AI accounts that works, with that account’s own key. When none can answer, they go to Firefight’s AI on Firefight’s cloud, or to the AI provider keys set up on the server when you run Firefight yourself.
Halon chats
Section titled “Halon chats”What you write to Halon is kept as a chat, whether you ask in the dashboard, mention @Firefight in a Slack channel or thread, write to the app in a direct message, or assign or mention Firefight in a Linear issue. The chat holds your messages, Halon’s answers and what its tools read along the way, stored encrypted. What Halon reads from your connected tools has its secrets taken out first, as described above. What you type reaches the model as you wrote it, so keep credentials out of your questions. See Chatting with Halon.
Files you give Halon
Section titled “Files you give Halon”Images, PDFs and text files you attach to a question are stored encrypted. Text files and the text of a PDF are scanned with the same redaction before Halon reads them, and a PDF holding a credential reaches the model as its redacted text only. An image is sent as it is. See Giving Halon a file.
What Halon remembers
Section titled “What Halon remembers”A memory that holds anything matching the credential formats above, or a connection string with a password in it, is refused rather than saved. Memory text is stored encrypted. See Halon’s memory.
Web searches
Section titled “Web searches”Halon and the agent that writes code fixes can search and read public web pages, such as a provider’s status page. The search words and the page address leave Firefight for its web search provider. A search or an address holding anything that looks like a credential is refused before it is sent, and so is an address that is not a public http or https one, such as a raw IP address or a name that only works inside your network. A workspace can make 1,000 web lookups a day. Every lookup is recorded in Activity. Turn it off under Settings → Workspace, with Let Halon search the web, and Halon works only from what your connections and code show.
What the coding agent reads
Section titled “What the coding agent reads”The agent that writes a code fix starts from what you asked, in your words, and from what Halon read before it, with anything that looks like a credential hidden. It works on a copy of the repository in a sandbox Firefight starts for the change. While it works it reads your connected tools as the person who asked for the change, with the same permissions, and never through a tool that changes anything. Each read is recorded in Activity.
The agent reaches its AI model only through Firefight, on the account and models described in Code fixes. Your AI account’s key and your connections’ credentials never enter the sandbox.
When Halon makes room
Section titled “When Halon makes room”A long chat or investigation can read more than the AI model holds at once. When that happens, Halon shortens its working notes. Older results are set aside and kept in full, so Halon can read any of them again, and nothing is deleted. In a chat, what you and Halon said to each other is always kept as it was.
In the dashboard, the chat and an investigation’s How it got there show a quiet line, Shortened its working notes to make room, with the time, where it happened. It is not counted as a step, and Slack shows nothing for it.
Every call is recorded
Section titled “Every call is recorded”Firefight records a usage entry for every AI call, capturing the feature, provider, model, token counts, cost, latency, and outcome, along with who or what triggered it. The usage record holds metadata only, not the prompt or the response text.
For what each feature does with this data, see AI in Firefight.