Retention at a glance
| Record | Normal window | What happens |
|---|---|---|
| Readiness audit request, report, and evidence | 7 days from creation | Public and workspace access ends at expiry; cleanup removes the row and dependent evidence. |
| Completed monitor jobs, scores, findings, and alerts | 90 days | History older than the plan window is removed in bounded cleanup batches. |
| Queued or running work | Until resolved | Kept until it reaches a terminal state or operational recovery closes it. |
| Account profile, membership, invitations, organization, and site configuration | Account lifetime | Kept while needed to provide and secure the workspace, unless deleted or a valid deletion request applies. Expired or revoked invitation links cannot be accepted. |
| Subscription and billing events | As operationally or legally required | Kept separately for subscription state, accounting, fraud prevention, and legal obligations. |
Automated cleanup
A scheduled cleanup removes expired free-audit data and terminal monitoring history outside the plan window. Read APIs also enforce expiry, so an expired report stops being returned even before its row is physically removed by the next cleanup batch.
Deleting or replacing a site
Workspace owners and administrators can remove a verified site after explicit confirmation, provided no scan is queued or running. Removal stops scheduling and deletes that site's monitor jobs, findings, score snapshots, and alerts. Aggregate usage accounting remains, and deleting a site does not cancel an active Paddle subscription.
Data intentionally kept outside product-history retention
Subscription records, raw billing events, and aggregate usage-ledger entries are not governed by the 90-day monitoring window. These records support billing integrity, quota enforcement, auditability, security, and legal obligations. When a related scan is deleted, the usage record can remain without its scan reference.
Provider backups and deletion requests
Deleted information may remain temporarily in restricted provider backups until the provider's normal backup cycle expires. To request account-level deletion or ask what information is associated with your email, contact privacy@agentwebtest.com. We may verify identity or domain control before acting.