Data Retention & Deletion

Overview

This policy describes how long AgentAudit retains customer data and how you can request deletion. It applies to all data submitted through the website, API, SDKs, or dashboard.

Retention periods

Active account data

While your account is active, we retain your organization profile, API key records, compliance rules, audit logs, alerts, and billing records. You can update most of this data from the dashboard at any time.

Audit logs

During the public beta, audit logs are retained for the lifetime of your account unless you request deletion. Future paid plans may introduce automatic age-based retention limits (for example, 30 days for Pro, 90 days for Business). We will notify users before enabling such limits.

Email delivery records

We keep email delivery records for 90 days to support deduplication, bounce handling, and support inquiries. After 90 days, these records are removed.

API keys

API keys are displayed once in plain text and then stored only as keyed hashes. Revoked keys are retained in hashed form to preserve audit history and prevent reuse. Raw keys are never recoverable.

Backups

PostgreSQL backups are retained for up to 30 days. If your account is deleted, your data may remain in backups for the remainder of that backup window.

How to request deletion

Self-serve deletion

You can delete your account and all associated data at any time from the dashboard (look for Delete Account in your organization settings) or by calling the API directly:

DELETE /api/v1/auth/organization
Authorization: Bearer <your-jwt>
Content-Type: application/json

{ "password": "your-account-password" }

This permanently removes your organization, API keys, agents, audit logs, policies, compliance rules, reports, alerts, and email delivery records from the active database. Any active Stripe subscription is canceled and the Stripe customer record is removed when billing is configured.

Email request

You can also request deletion by emailing us at support@agentaudit.online from the email address associated with your account. We will confirm the request, delete the data within 30 days, and notify you when deletion is complete.

Exceptions

We may retain data beyond the standard periods if:

• We are required to do so by law or legal process.
• The data is necessary for an active investigation of abuse, security incident, or dispute.
• The data is aggregated or anonymized so that it can no longer identify you or your organization.

Changes

We may update this policy as retention practices change. We will notify you of material changes by email or through a prominent notice on the website.

Contact