Deletion schedule
Closing an account keeps data restricted for 30 days and then deletes it. An explicit erasure request is honoured within 30 days. Execution evidence (hashes only, no personal data) is retained for 6 years.
Last reviewed on 2026-09-19.
Account profile, organisation profile and membersDeleted
At the end of the 30-day grace period (reversible until then)
Notification preferences, CI tokens, badges, accessDeleted
At the end of the grace period
Personal identifiers in runs, disclosures, acceptances and batchesDeleted
Pseudonymised irreversibly at the end of the grace period
Execution evidence: event chain, attestations, findings and evidence filesRetained
Retained 6 years from each run for legal-claims defence and statutory record-keeping; not deletable on request
Retention periods follow the Evidence policy and the Data Processing Agreement. An active legal hold pauses deletion until the case is closed.