Org data is never permanently stored by Gearset, but it does pass through our servers to allow us to run data deployments. After a data deployment completes, the data is automatically disposed of by the service. As with metadata, it is encrypted at all times when in transit or at rest. Learn more on our security page.