Data Retention and Deletion
Retention windows by data category, account and organization deletion flow, for both deployment models
Data is kept strictly for as long as necessary for the purpose of processing and legal obligations, then irreversibly deleted. The windows below cover both the Shared Model (SaaS) and the Enterprise (Dedicated) Model; implementation differences are shown explicitly in the columns.
Retention windows
| Category | Shared Model (SaaS) | Enterprise (Dedicated) Model | Mechanism |
|---|---|---|---|
| Signing audit trail | 5 years | 5 years | CloudWatch Logs append-only — a worker injects the source and data from both platforms |
| Client activity logs | 3 months, rotated automatically | 3 months default, configurable per client | In-platform; downloadable monthly by the client |
| Access logs (IP, browser, time, account) | 30 days | 12 months default, contractually extendable | New Relic (Shared) / CloudWatch Logs (Dedicated) |
| Postgres backups | 30 days | 30 days | Continuous PITR + daily snapshots |
| Documents (S3) | Versioning + geographic replication | Versioning + geographic replication | Lifecycle policy: versions expire automatically 100 days after deletion |
| Employee data (Postgres + S3 documents) | Until manually deleted by the client | Until manually deleted by the client | Deleting an employee triggers cascading deletion of attached documents |
| Accounting/financial data | Legal deadlines | Legal deadlines | In accordance with applicable accounting legislation |
Principles
- Data that has become unusable or reached its expiry is irreversibly deleted/destroyed from all databases and storage media.
- As an exception, data may be stored for longer periods if necessary for the defense of a legal right in court.
Account vs. organization
To understand the deletion flow, we distinguish two separate entities:
- User account — identified by email address; represents a person's access to the platform and to one or more organizations. Personal information associated with the account is minimal (mainly the email).
- Organization (tenant) — the entity in which operational data is stored: employees, documents, configurations, activity logs.
The deletion flows described below apply separately to these two entities.
User account deletion
Shared Model (SaaS)
Inactive accounts no longer affiliated with any organization are automatically deleted after 12 months of inactivity. Reactivation within this period (login with the existing email) resets the counter.
For accounts with a commercial flag (associated with a company for billing purposes), the company's data (name, tax ID, address, etc.) is kept in accordance with applicable accounting legislation, independent of user account deletion.
Organization deletion
Organization deletion is performed directly by the client from the platform (self-service action). As a protection mechanism against accidental deletions, the operation is implemented as a soft delete:
- Soft delete (90 days) — the organization is marked as deleted and becomes inaccessible, but the data remains recoverable via a request to technical support within this window.
- Permanent deletion — after 90 days, the organization and all associated data (employees, documents, configurations) are irreversibly deleted in cascade.
Suspension for non-payment
In accordance with the Terms and Conditions:
- Suspension: after 30 days from the unpaid due date
- Reactivation: possible within 90 days by paying outstanding amounts
- Reactivation failure: the organization enters the standard deletion flow described above
Contract termination
Enterprise (Dedicated) Model
Upon termination of the contract for a dedicated instance, a final data export is performed for the client, followed by complete destruction of the dedicated AWS infrastructure (Postgres, S3, CloudWatch, and remaining resources). The export window is established contractually per client.
For operational details about the final export — see Termination and Portability.
Portability before deletion
Tenants can export their data at any time, including via automatic daily export to their own external archive — see Termination and Portability.