What we store, and for how long.
Every window and field below is read from the code that enforces it — our retention policy and the on-prem sensor's field allowlist — so this page can never say something the platform doesn't do. It is generated, not written by hand.
How long each class of data lives.
| Data class | What it is | Retention |
|---|---|---|
| scanData | Raw scan results, CloudTrail blast-radius, and risk snapshots — 90 days from creation. | 90 days from creation |
| findings | Findings kept while open (OPEN/IN_REMEDIATION); deleted 365 days after resolution. | 365 days after resolution |
| auditLog | Audit log — 1 year from creation. | 365 days from creation |
| trustLedger | Append-only Trust Ledger — permanent by design (tamper-evident record; never deleted by retention). | Permanent — append-only, tamper-evident; never deleted by retention |
| activityTelemetry | Behavioral & location telemetry (ActivityEvent: identity reference incl. email, source IP, geo lat/lon/country, ASN, user-agent, token/session id, resource, action) — 180 days from creation. | 180 days from creation |
| authTelemetry | Authentication & credential-access telemetry (AuthEvent and CredentialAuditEvent: actor id, IP, user-agent) — 180 days from creation. | 180 days from creation |
| enrollmentAttempts | Failed component-activation attempts (the source IPv4 address, or an IPv6 source’s /64 network; the reason it failed; and the organization whose code was presented) — security telemetry for the activation lockouts and the owner’s diagnostics; 2 days (48 hours) from creation, and deleted with the organization at offboarding. | 2 days from creation |
The scheduled purge job is built: it applies these windows per tenant and records each deletion batch as a signed, append-only Trust Ledger entry. It runs on the retention tick wherever the tick secret is configured. The ledger itself is permanent by design — deleting it would destroy the proof that we ever held you accountable.
The exact fields the sensor may send — nothing else.
The read-only on-prem sensor emits only non-secret posture metadata. The server drops any field outside this allowlist before it can be evaluated or stored. These groups are the live allowlist, by data class:
actorIdclusterRolegrantScopegroupnamepolicypolicyNameprivilegeresourceroleNameroleRefsecretPathhostsourceIptokenIdmodepasswordAgeDaysttlSecondsuiduserAccountControlasrepRoastableautomountDefaultSaclusterAdmindbOwnerdomainAdmindontReqPreauthgrantAllgroupReadableisRootAccountloginShellnoApiCallsotherReadablepasswordNeverExpirespasswordlessperiodicNonExpiringrootTokenstaticCloudCredentialsudosuperuseruid0wildcardResourceswildcardSecretPathwildcardVerbscredTypeskeyTypesecretTypesWhat we never collect.
- Secret values — passwords, tokens, private keys, API keys. The on-prem sensor collects identifiers and fingerprints only.
- Any on-prem field outside the published allowlist below — dropped at ingest, before it can be evaluated or stored.
- File contents, message bodies, or database rows — only non-secret posture metadata is observed.
src/lib/data-lifecycle/retention-policy.ts · src/lib/monitoring/onprem/field-allowlist.ts