Skip to main content

Data Retention and Deletion

This page explains how long Controlio keeps your monitoring data, when it deletes it automatically, and how it deletes it at your request.

Standard retention: 1 year​

The standard history retention period is 366 days (1 year). The database containers that hold history data (configSnapshots, goldenAudit, driftFindings, goldenProposals, vipLiveEvents, securityEvents) have a time-to-live (TTL) set; standard history older than one year is deleted automatically. This avoids keeping data indefinitely for no reason.

Extended retention — planned option

A longer retention period, such as two years, may be offered as a separate paid package/option. This option is not yet built; its price and the related legal text require separate product and legal approval.

After the license ends​

  • When your trial or paid license expires, a 30-day grace period starts.
  • If you renew within 30 days, your history is preserved.
  • If you do not renew, your tenant's CCM / TrueState / VIP Guard history data is deleted automatically.

This deletion is tenant-scoped and resolved only by your immutable tenant id; no other tenant's data is touched. It is safe to run again. When deletion completes, a deletion proof that contains no personal data (tenant id, timestamp and deleted-row counts) is kept in a separate, never-purged record.

Early deletion request​

You can request deletion of all your monitoring data without waiting for the standard period to end. This does not run instantly and irreversibly on a single click; it goes through a strong confirmation step that clearly explains the scope and outcome. The request is initiated by your authorized tenant administrator and leaves an auditable record.

The deletion request process and its verification are defined in our service team's operations runbook.

The retention and deletion rules above concern your monitoring/security data. Records that may need to be kept for legal reasons, such as invoices and contracts, are assessed under a separate scope. The exact boundaries of that scope are subject to legal-counsel approval.