Where your data lives, and how long we keep it
Customer content stays in your organisation's region. These providers run parts of the service, and your owners and admins choose how long most kinds of data are kept.
Your region
Chosen once, when we set up your organisation.
- Hosted on Amazon Web Services in the region chosen for your organisation when we set it up: India, the European Union (Germany, with backup copies in Ireland) or the United States. Organisations in the United Kingdom use the European Union region.
- Your firmware, code, database, files and backups are stored and analysed in that region, and the service's email to your members is sent from it through Amazon SES.
- An organisation's region changes only under a new written agreement.
- Whichever region you use, your support requests (Zoho Desk) and our customer records about your organisation and its people (Zoho CRM) are kept by Zoho in India.
- Our support and operations staff work in India and open your data only to do what you asked, such as preparing an export or answering a support request, or to keep the service secure.
Providers of the service
Where each provider processes data. Annex B of the Data Processing Agreement lists what each one receives.
Provider
Processing location
- Amazon Web Services India Private Limited and Amazon Web Services, Inc. (AWS)The organisation's region: India, the European Union (Germany, with backup copies in Ireland) or the United States
- Amazon Web Services (Amazon CloudFront and AWS WAF)Global edge network; the firewall's records in India
- Amazon Web Services (Amazon SES)The organisation's region; recipients' own mail systems may be elsewhere
- Cloudflare, Inc.Global network
- Functional Software, Inc. (Sentry)USA
- Zoho Corporation Private Limited (Zoho Mail)India
- Zoho Corporation Private Limited (Zoho CRM, Zoho Desk and Zoho Campaigns)India
You decide how long we keep it
Owners and admins choose how long firmware images, source code, reports, the audit log and closed risks are kept, under Settings, Organisation. Everything else is fixed.
| Data | Default | Choices |
|---|---|---|
| Firmware images | 1 year | 30 days to 10 years |
| Source code | Deleted after each scan | Kept 30 days to 10 years if you choose |
| Reports | 10 years | 1 to 10 years |
| Audit log | 2 years | 1 to 10 years |
| Results | While the organisation exists | Until you delete their release or product |
| Risk decisions | While the organisation exists | Closed risks 3 to 10 years |
| Deleted products, releases, repositories and reports | 14 days in Recently deleted | Fixed |
| Data exports | 7 days | Fixed |
| Webhook records | 30 days | Fixed |