Docs / Data Retention

Data Retention

Understanding data retention is important for compliance. This guide explains how SAR Portal manages data throughout its lifecycle.

Retention Overview

Data Type Active Period After Closure Retention Period
Case Data While open Anonymized 7 years (audit only)
Documents While case open Deleted None after closure
Audit Logs Always Preserved 7 years
User Data While active On request Until deletion

Case Data Retention

Active Cases

While a case is open:

Closed Cases

When a case is closed:

Anonymization

After a retention period (configurable):

Why Hash the Email?

The email hash allows:

Document Retention

During Active Cases

Document Deletion

When documents are deleted:

Soft Delete (Immediate)

Permanent Delete (On Case Closure)

After Case Closure

All documents are permanently deleted:

This aligns with data minimization principles - don’t keep data longer than necessary.

Audit Log Retention

Standard Retention: 7 Years

Based on:

What’s Retained

What’s NOT Retained Long-term

User Data Retention

Active Users

Full account data retained:

Deactivated Users

When a user is deactivated:

User Deletion

On GDPR deletion request:

Tenant/Organization Retention

Active Organizations

All data retained:

Organization Deletion

When the last admin deletes the organization:

  1. Immediate

    • All user accounts removed
    • Stripe subscription cancelled
    • Login disabled

  2. Within 30 Days

    • All cases anonymized
    • All documents deleted
    • Blobs removed from storage

  3. Retained

    • Anonymized audit logs (7 years)
    • Billing records (legal requirement)

Configuring Retention

Case Anonymization Timing

Configure when closed cases are anonymized:

Go to Settings > Advanced to configure.

For cases under legal hold:

Data Minimization

SAR Portal follows data minimization principles:

Collect Only What’s Needed

Store Only While Needed

Delete When No Longer Needed

Compliance Reports

Generate retention compliance reports showing:

Your Responsibilities

As the data controller, you should:

  1. Inform Data Subjects

    • Include retention periods in privacy notice
    • Explain anonymization vs deletion
    • Describe audit log retention

  2. Configure Appropriately

    • Set retention periods matching your policy
    • Enable legal holds when needed
    • Review settings periodically

  3. Honor Deletion Requests

    • Process account deletions promptly
    • Understand what can/cannot be deleted
    • Explain retained audit logs

Audit log retention is based on:

This is documented in our DPA and privacy notice.