Skip to content

Security & retention enforcement

The retention values in our Privacy Policy are enforced by scheduled database sweeps and per-object cleanup alarms. This page documents those controls, including the historical finite-quota exception below.

Automated retention enforcement

A scheduled job runs daily at 03:17 UTC inside our API worker and hard-deletes database rows by age. Finite quota objects use per-object cleanup alarms. Older fallback objects that predate those alarms have the exception stated below. Account deletion is immediate and cascades to all of the customer's database rows. Current schedule:

  • Raw crash logs (Free and Team): 30 days
  • Diagnosis results, failure signatures, follow-up chat, and feedback: 90 days (Growth and Data Center: 1 year)
  • Alert delivery log (subject, recipient, timestamp): 90 days
  • Rate-limit event rows (keyed pseudonymous IP tokens; no raw IP addresses): 2 days
  • Current finite quota counters and refundable claim receipts: New or subsequently touched records are deleted through 8 days after the UTC quota day. Anonymous IP, coarse-network, and daily-browser quota tokens rotate each UTC day. Older day-scoped fallback objects created before August 28, 2026 can persist under the provider storage lifecycle; they contain keyed pseudonymous tokens, counts, and opaque claim metadata, never raw identity signals.
  • Login attempts (email + IP, brute-force defense): 30 days
  • Payment-event records (Stripe webhook events): 30 days
  • Cookie-consent receipts: 3 years
  • Consent-gated activation funnel events: 30 days (closed enums and temporary tab-scoped identifiers only)
  • Public diagnosis share snapshots: Hard-deleted after expiry. Revocation blocks access immediately, followed by a 7-day recovery grace before hard deletion.
  • Audit log (tamper-evident SHA-256 hash chain, retained for SOC 2): 2 years
  • Billing records (retained to meet US tax obligations): 7 years

Encryption

All traffic is TLS 1.3 in transit. Data at rest is encrypted by our infrastructure provider (Cloudflare). Data Center customers can supply or generate an AES-256-GCM data key for diagnosis logs. Denpex wraps that key with a key-encryption key held as a Worker secret and can decrypt while the data key is active. This separates the data key from the database, but it is not customer-held KMS or HSM custody.

Access control & tenant isolation

Every API query is scoped to the authenticated customer's ID at the database layer (row-level security enforced in code and covered by integration tests). Sessions are short-lived JWTs; API keys are revocable per key. Client-side privacy masking on the agent scans for and redacts PII/PHI before any log leaves the customer's host. On Scale, Growth, and Data Center plans the agent runs inside your own VPC, so raw logs never leave your boundary, only anonymized failure signatures (failure type, fix, timestamps) are sent off-cluster.

Where to go deeper

The Security page covers the full program. The Trust Center hosts our SOC 2 status, sub-processor list, data-flow diagram, and one-click requests for DPA, BAA, and assessment documents. Report vulnerabilities to security@denpex.com.