Does Element 31 see our data?

No. Element 31 has no path to the data on a Czar, and the absence is structural rather than contractual. Camera feeds, captures, task records, adapted model weights, and the record of every decision stay on the operator's hardware inside the operator's network. Customer appliances never connect to Element 31's customer portal, in any posture. Support, when the customer wants it, is a session the customer starts, and on a sovereign site it opens only after the customer attests to the conditions and closes on a hard expiry.

Why there is no path

An air-gapped Czar has no route out at all. Updates arrive as signed bundles carried in on media, and nothing is carried back. A connected Czar talks only to systems the site already secures, over routes the site declared, and Local Bridge in Substrate denies every other route by default. Element 31 is not a declared route. Neither is a vendor's cloud.

The customer portal, where support, billing, signed update downloads, and remote sessions live, is reached from the customer's own connected systems. The appliance does not reach it. That one-way arrangement is what lets the portal exist without becoming a door into the building.

What a support session looks like

A remote session is customer-initiated, always. Element 31 cannot open one. When the customer does, the session's scope is whatever the customer makes available for the duration, and the duration is bounded.

On a sovereign site the bar is higher. Before an uplink window is approved, the customer attests to four conditions: the data disks are detached, the network is isolated, the console is supervised, and the person requesting has the authority to do so. Only then is the window approved, and it carries a hard expiry. What an Element 31 engineer sees in that window is a node with its data detached, under the customer's eye, for a fixed span the customer agreed to. When the window closes, the path is gone again.

Updates follow the same rule. The customer downloads a signed bundle from the portal and brings it to the appliance. Element 31 does not push anything, because there is nothing to push along.

What this means in practice

A plant's adapted perception model, which encodes what its parts and fixtures look like, stays in the plant. A terminal's outdoor feeds stay on the terminal. A warehouse's record of every decision the pool made for every robot stays in the warehouse. Element 31 provides sustainment and attestation for the node and never holds the data the node serves or produces.

That is also why Element 31 cannot pool one customer's captures or adapted weights into a model for another. Each site adapts for itself, on the pool, and keeps the result.

The honest limit of the answer is this: Element 31 sees what a customer chooses to show during a session the customer started, for as long as the customer allowed. Nothing else. The technology page covers Local Bridge and Watchman, What is recorded, and who can read it covers the record, and How do updates reach an air-gapped site covers the media path.