Retention and deletion

Retention is where data policies are usually vaguest, because a precise answer is a commitment. This article states the lifecycle every record passes through, what is kept per category, the difference between deletion in the application and expiry from backups, what happens when a contract ends, how to make a deletion request, and the small set of records we are legally obliged to keep whatever you ask.

#The lifecycle of a record

Every record we hold moves through the same six stages. Nothing skips a stage, and nothing sits in a stage indefinitely without an owner.

1. 1

   Collection under scope

   A record is created only if a signed scope covers the environment it came from. Discovery that falls outside the agreed scope produces a gap report rather than a record. See What we hold, and what we never take.

2. 2

   Processing

   Detectors normalise the raw observation into inventory metadata, findings and a bounded evidence snippet. Credential-shaped and token-shaped strings are redacted at this point, before anything is persisted.

3. 3

   Active retention

   The record is live in your workspace, visible under your role model, and included in exports and scoring. Its retention clock starts at the trigger named in the table below.

4. 4

   Minimisation

   Evidence snippets and raw telemetry are pruned on their own schedule, ahead of the inventory they support. A finding usually outlives the byte-level evidence behind it, and keeps a hash reference instead.

5. 5

   Deletion in the application

   Triggered by your request, by a workspace retention setting, or by contract end. The record becomes unreachable through every interface, export and API, and the deletion itself is logged.

6. 6

   Expiry from backups

   Backups age out on a fixed rotation. Until the last backup containing a record expires, that record exists in encrypted form even though it is gone from the product. This stage is explained in full below.

#Retention by category

The durations below are configured per workspace within the bounds of your contract. Where a placeholder appears, the figure is set commercially rather than by us unilaterally, and it will be stated in your order form.

Category	Retained for	Clock starts at	Notes
Inventory metadata and findings	Life of the engagement plus [PLACEHOLDER: retention period]	Contract end date	Kept so that year-on-year trend and audit evidence survives a renewal gap
Detector evidence snippets	[PLACEHOLDER: evidence snippet retention period]	Date the finding was raised	Pruned ahead of the finding; a hash reference remains for chain of evidence
Scoped discovery credentials	Until the scope window closes, and no longer	Completion of the last job in scope	Deleted at engagement end regardless of contract term; never carried into a renewal
Generated reports and attestations	[PLACEHOLDER: report retention period]	Date of issue	Retained so an Attestation Lookup result stays verifiable for its stated validity window
Account and workspace records	[PLACEHOLDER: account record retention period] after the last workspace is closed	Closure of the final workspace	Includes role assignments and membership history
Security and access logs	[PLACEHOLDER: security log retention period]	Date of the logged event	Includes break-glass records; not shortened on request, for the reasons below
Service telemetry	[PLACEHOLDER: telemetry retention period]	Date of the request	Aggregated well before expiry; identifiers stripped at aggregation
Billing and tax records	[PLACEHOLDER: statutory financial record retention period]	End of the financial year of the invoice	Governed by statute, outside the scope of a deletion request

#Deletion in the application is not expiry from backups

These are two different events, and conflating them is how vendors end up making a promise they cannot keep. Deletion in the application is immediate and verifiable: the record stops being reachable through the interface, the API, exports and support tooling, and an entry is written recording that it happened. Expiry from backups is a scheduled process: our backup rotation holds encrypted snapshots for [PLACEHOLDER: backup retention period], and a record deleted today persists inside those snapshots until the last one containing it ages out.

We would rather explain this than claim instant erasure everywhere. Any provider offering both point-in-time recovery and immediate cryptographic erasure from every backup is describing two things that are difficult to hold at once, and the honest version of the answer is a schedule.

#When a contract ends

Contract end starts a defined sequence rather than a conversation. Nothing here requires you to chase us.

1. 01Export window. For [PLACEHOLDER: post-termination export window] the workspace is read-only and every export remains available. Take the machine-readable inventory as well as the reports; Cryptographic bills of material covers the format, and What to hand an auditor covers what an assessor will want.
2. 02Credentials destroyed first. Any discovery credential is deleted at the close of the final job, ahead of everything else, whether or not you have revoked it at your end.
3. 03Application deletion. At the end of the export window, inventory, findings, evidence and workspace records are deleted from the live platform on the schedule in the table above.
4. 04Backup expiry. Encrypted snapshots age out over the following [PLACEHOLDER: backup retention period].
5. 05Written confirmation. We issue a certificate of deletion naming the workspaces, the categories deleted, the date of application deletion and the date the last backup expires. Requests and queries go to /contact.

#Making a deletion request

A deletion request can cover a single asset, a project, a whole workspace, or every record we hold about your organisation. Requests are actioned within [PLACEHOLDER: deletion request turnaround], and you receive the same written confirmation described above.

Who may ask

A workspace owner, or the contract signatory named in your order form. We verify the requester against the workspace role model before acting; see Roles and permissions.

How to ask

Through /contact, naming the workspace and the scope of the request. An individual exercising a statutory right may also use the route in Privacy.

What you get back

An acknowledgement, then a certificate of deletion listing categories, counts, the application deletion timestamp and the backup expiry date.

What we will confirm

That the records named are unreachable in the product, and the date after which no copy exists in any backup.

What we will not confirm

That a copy you exported, or a report you circulated internally, has been removed from your own systems. Those copies are outside our control.

#What we are obliged to keep

A deletion request cannot reach everything, and a vendor that says otherwise has not read its own obligations. The exceptions are narrow and each has a reason.

• Financial and tax records. Retained for [PLACEHOLDER: statutory financial record retention period] under Indian statutory accounting requirements. These contain billing identity, not inventory data.
• The record of the deletion itself. Erasing the evidence that we honoured your request would leave neither of us able to prove it.
• Security and access logs. Retained for their stated window so that an investigation into unauthorised access remains possible. Shortening them on request would remove the ability to detect misuse of the very data being deleted.
• Material under legal hold. Where we are required to preserve records by a court, regulator or lawful order, preservation overrides deletion. We will tell you that a hold applies unless we are prohibited from doing so.
• Aggregate, non-identifying method statistics. Counts used to version and evaluate the scoring model, carrying no workspace or asset identifier and not reversible to your estate. See How the method is versioned.

This page describes operational practice. The lawful basis, the processor obligations and your statutory rights are set out in the notice, with the commercial terms in Terms.Read the privacy notice