# What is stored where

URL: https://docs.nolay.ru/en/concepts/data/
Updated: 2026-09-23

> Which data Nolay keeps, which stays only on your server and what support can see.

The main rule: code, data and secret values live on your server and in your storage. Nolay keeps only settings and the service information the panel needs to show the state.

## In short

| Data | Where it lives | At Nolay |
|---|---|---|
| Source code | on the server, in `/var/lib/nolay` during the build | no |
| Container images | in Docker on the server | no |
| Project data (volumes, databases) | on the server | no |
| Secret values | on the server, encrypted | no, only key names |
| Backups | in your S3 storage | no, the S3 keys are yours too |
| Application logs | on the server, streamed to the panel on request | no, the panel does not keep them |
| Account, organization, roles | in the panel database | yes |
| Project settings and version history | in the panel database | yes |
| Events, metrics, action log | in the panel and hub databases | yes |

## Panel

Keeps the account, organization, servers and projects with their settings, version history, events and server metrics. Secrets are kept only as names and a fingerprint of the set. A code archive streams through the panel and is not saved.

## Hub

Keeps the list of agents and their tokens, the command queue until delivery, events and metrics. An archive uploaded through the panel stays on the hub for no more than 15 minutes, until the agent takes it. Secret values in the command queue are encrypted.

## Your server

| Path | What is there |
|---|---|
| `/etc/nolay/agent.toml` | the agent config |
| `/etc/nolay/agent.token` | the connection token |
| `/etc/nolay/agent.key` | the secrets encryption key, not included in backups and never sent to the hub |
| `/var/lib/nolay` | the agent database (SQLite), build sources, repository cache |
| `/var/lib/nolay/caddy` | proxy certificates and state |

A copy of the agent database does not reveal secrets without `agent.key`.

## What support can see

Support sees what the panel keeps: server and project names, settings, statuses and events. Nolay has no access to the server: the agent has a closed list of commands, and an arbitrary command cannot be run on the server through Nolay. Secret values and database contents are not available to support because Nolay does not have them.

## Check it yourself

```sh
# the agent listens on no inbound ports
ss -tulpn
# the agent does not run as root
ps -o user,pid,cmd -C nolay-agent
# the status shows only secret names
sudo nolay-agent status
```

## Next

[Security](/en/security/): the trust model and the agent's rights.