Data classes

We keep an explicit internal data map that inventories every stored category, its processing purpose, and its default retention. Each category is classified so the right handling rules apply:

Configurable retention

Each category has a default retention window, configurable per deployment. A background purge worker enforces the windows once an operator enables it for the environment, so retention is a deliberate, reviewable setting rather than an accident of how long a table grows. Representative defaults:

Identifiers, credentials, configuration, authorization, and billing records are kept for the lifetime of the owning account, tenant, or subscription and are removed through the data-subject erasure flow below (or retained where a legal obligation applies) — they are not subject to a time-based purge.

Data minimisation

We collect the minimum needed to operate the service and avoid building a separate raw-telemetry pipeline:

• No raw user-level activity exports, raw IP/geolocation, browsing history, or session replay.
• No raw device hardware fingerprints beyond the device-trust lifecycle records required for activation and licensing.
• Compatibility analytics store normalised route templates, not raw request paths.
• No token material, secrets, key contents, or customer business payloads are captured as telemetry.
• Operational analytics are derived from records already required for trust and licensing rather than from new endpoint collection.

Aggregate-analytics suppression

Organisation analytics publish bounded aggregates only. A metric whose underlying count is below the configured minimum cohort size (default 5) is suppressed rather than published, so small groups cannot be re-identified from an aggregate. A bounded differential-privacy mode exists as an off-by-default pilot for approved aggregate counts; there is no per-user risk score, raw telemetry lake, or cross-tenant data pooling. See the privacy-preserving analytics guide for the full boundary.

Data-subject access & erasure

A tenant administrator can export and erase the data a tenant controls for a given person — the records tied to that person's memberships in the tenant's organisations, not the person's global account, which may span tenants. Both operations are scoped to the tenant, gated by tenant-administration authorisation, and recorded as audit events.

• Export collects the person's tenant-scoped records into a portable artifact.
• Erase removes the person's tenant-scoped records and reports, per category, what was erased and what was retained.
• Retained by obligation: security and compliance audit events are retained — not erased — and the erasure report states this explicitly with the reason, so an obligation is never silently dropped.

Coverage is provided per category behind a common interface and expands over time; initial automated coverage includes membership profiles (erased) and audit (retained under obligation). Categories without automated coverage are reflected honestly in the erasure report rather than assumed handled.