Data Retention Policy

The retention window

When a subscription terminates, the workspace enters a retention window of 60 days before its data is erased.

The window length is recorded on the workspace's own retention record at the moment it starts. A later change to the platform default therefore cannot shorten a period a customer has already been told about.

A second termination does not restart the clock.

Holds

Erasure can be suspended by a hold — legal, security, billing dispute or administrative. Several holds can exist at once for different reasons, and releasing one does not release the others. Erasure resumes only when the last hold is released. Placing and releasing a hold are both audited.

Deletion requests

A workspace owner can request deletion. The request is reviewed by a platform operator; it is never executed on submission. Confirmation requires typing the workspace name, checked on the server.

What erasure removes

Relational tenant data, stored files, integration credentials and tokens, and tenant configuration.

What is retained

A record that the erasure happened — when, why and who authorised it — is retained deliberately, because it is the evidence the erasure occurred. It does not contain the erased content.

Commercial records that belong to the customer rather than the workspace — orders, refunds and contracts — are retained for business-record purposes.

Backups

Erasure removes data from the live production database through the platform's erasure process. Residual copies may remain temporarily in managed provider backups until those backups expire or are overwritten under the provider's ordinary retention cycle. Backup copies are not restored for ordinary customer access after an erasure request has been completed.