Data retention and deletion policy.
Retention periods for each data category, the deletion method, and the backup expiry window.
01Principles
- Nothing is kept without a reason. Each data category below has a stated retention period tied to why it exists.
- Retention is enforced by the product. The retention job runs inside REQOPS itself.
- Deletion is physical, not just logical. Deleted means destroyed to the recognised standard (NIST 800-88), not flagged hidden.
- The customer owns the clock. As controller of the records, the deploying organisation can set shorter windows; the defaults below are the standing policy.
02The schedule
| Data category | What it is | Kept for | Why |
|---|---|---|---|
| Monitoring records | Work activity: who did what, where, when, and whether policy allowed it. | Life of the subscription, or the shorter window the customer configures. | The observatory's working record; the customer controls it. |
| Audit log | Who looked at whom, and why — hash-chained, append-only. | Life of the subscription; exported to the customer at offboarding. | The record relied on in disputes and audits — it leaves with you. |
| Accounts & invites | Names, emails, roles, invite tokens. | While the account is active; removed with the account. Unused invites expire. | Access control only. |
| Policies & notice ledger | The monitoring rules and the proof staff were told. | Life of the subscription; exported at offboarding. | Evidence that notice preceded enforcement. |
| Backups | Operator-made encrypted copies, taken by runbook. | Deleted no later than 35 days after being taken. | One monthly drill cycle plus a margin — and the ceiling the DPA promises. |
| Contact & sales email | What you send to hello@reqops.io. | Up to 2 years after the conversation ends, then deleted. | Continuity of the relationship. |
03What “deleted” means here
When a record is erased, the product destroys it at the storage layer: freed pages are zeroed as part of the delete, the write-ahead log is checkpointed and emptied so no pre-delete frame survives, and the database file is rewritten so even the freed-page structure is gone. After that sequence, recovering the deleted rows from the live file, its log, or file-carving tools is not possible. Disk-level copies are covered by full-disk encryption at rest and by the backup window below.
04The backup window
A backup copy is deleted no later than 35 days after it was taken. Whoever hard-deletes a person's records also deletes any backup copies older than the deletion — or notes in the audit ledger why one must be retained. The worst-case persistence of deleted data in our custody is therefore 35 days, and that is exactly what the data processing agreement promises.
05Legal hold — the one exception
If law or litigation requires holding something past its date, it is frozen, logged in the audit ledger, and released the moment the obligation ends — never quietly kept.
06Offboarding
Offboarding follows three steps: data is exported in standard formats first, then deleted on this schedule, then a written deletion confirmation is sent. The customer receives a complete export; REQOPS retains nothing.