Legal
Data Retention & Disposal Disclosure
Effective Date: November 2, 2026 (Version 2026.3)
1. Retention Windows
- Security Assessment Reports: stored for the retention period your organization sets (default 90 days; 30 to 365 days).
- Findings & Evidence Envelopes: kept and deleted with the report they belong to.
- Audit Trail Events: up to 365 days. They never contain secret values or source code.
- Sign-in Records, Security Events & IP Addresses: kept one year (DPDP Rules, security logs); IP addresses in sign-in records are masked after 30 days.
- Website access logs: one year.
- Exports and downloads: 72 hours. Dependency fix patches: 1 hour.
- Secure Share: encrypted content until the last permitted view, revocation or expiry (at most 72 hours); the record a day after expiry.
2. Disposal at the End of a Scan
- Repository copies: deleted from disk when the scan completes or fails.
- Single-use tokens: a token you give for one scan stays only in memory for that scan and is never written to the database.
- Saved credentials: a token or key you choose to save is stored encrypted until you delete it; a "keep for ten minutes" token is deleted after ten minutes.
3. Deletion and Backups
Deleting a report deletes its findings, threat models and release-gate records with it. Deleting an organization deletes all of its data. When DVSentry closes an organization, it is suspended for 60 days, then deleted, and an encrypted archive is kept for 90 days before it is purged. Encrypted database backups roll off within 35 days, so deleted data can remain in them until then; they are used only to restore the service.