Retention Policy

Version 1.0, approved 2026-09-21. The figures here are the ones the code enforces today (environment settings in .env.example) and the decisions recorded in D08, D09, D10 and D25. One is explicitly interim and is marked as such.

Principle

Data is kept for as long as it is needed for the purpose it was collected for, and the length is published here before it is enforced. We make no claim that anything is kept indefinitely, and no claim that anything is deleted sooner than this page says.

The schedule

Data	Kept for	Then	Notes
Documents (original, edited, signed and certificate PDFs), fields, recipients, signatures, attachments, audit trail	While the organisation keeps them	Deleted when the organisation deletes the document — see the exception below	Automatic time-based deletion is off (JSIGN_DOCUMENT_BINARY_RETENTION_DAYS=0), an interim decision (D10) that stands until the deletion safeguards have been verified against production data. When a window is set it will be published here with an effective date before it applies.
Signature images	With the document	—	JSIGN_SIGNATURE_RETENTION_DAYS=0 (off), same interim decision
Email delivery events	While useful for delivery evidence and suppression	—	JSIGN_DELIVERY_EVENT_RETENTION_DAYS=0 (off), same interim decision. Suppression of addresses that reported our mail as unwanted is kept regardless.
Sign-in sessions	Up to 30 days from sign-in	Expire	Shorter when "remember me" is not chosen
Magic-link and invitation tokens	15 minutes (magic link); until used or expired (invitation)	Expire
Nonprofit verification letter	90 days after the decision	Deleted	Decision D08. A Pub 78 lookup reference, rather than a document, is preferred and is kept with the record.
Nonprofit verification record (EIN, decision, date, reviewer)	With the organisation	—	Decision D08
Nonprofit fingerprint (keyed EIN hash with decision, date, reviewer) and founding-offer redemption	Survives organisation deletion for 24 months	—	Decisions D08, D09: this is what stops a one-per-entity offer being claimed twice by re-registering
The trial: start, end, allowance, and its envelope ledger	With the organisation	—	Decisions D18, D19
Trial redemption record: keyed hash of the mailbox and of the origin network address, outcome, denial reason	Survives organisation deletion for 24 months, the same as the fingerprint	—	Decision D18: one trial per organisation, not per registration. The address and mailbox are not recoverable from the hash.
The subscription's pricing class (standard or nonprofit) and a confirmed switch scheduled for the next renewal	With the organisation	—	Decisions D20–D22
A saved payment method for a nonprofit-priced purchase awaiting verification	Held by Stripe until verification is approved, declined or lapses, or 30 days at most	Released, nothing charged	Decision D14 (a); the card itself is never held here
Data export archives	24 hours after they are produced	Deleted	The export record (that one was made, by whom, when) is kept
Operator audit log	Indefinitely	—	The hash chain is the control; removing entries would defeat it
Application logs	30 days	Deleted	Redacted before writing
Rate-limit counters, idempotency keys, worker leases, storage reservations, alert state	Minutes to a week	Expire	Operational
Queue jobs	14 days	Deleted	JSIGN_QUEUE_RETENTION_SECONDS
Backups	Encrypted bundle nightly; 14 kept on the host, off-box copy 35 days (decided 2026-09-20 and recorded in the product decision register under off-box backup retention)	Deleted by the store's lifecycle rule	T05; the bundle holds every class above, so this bounds how long a deleted record can still exist inside a backup

The shared-file exception

A template and every document created from it share one PDF file rather than each holding a copy. Deleting a document therefore removes its bytes only when nothing else still refers to them; a reference ledger answers that question before anything is removed, and a file that cannot be deleted for that reason is reported rather than silently kept. This is why automatic deletion stayed off until the ledger had been proven against real data.

Legal holds

Where we are legally required to preserve data — a court order, a regulatory request, a dispute we have been notified of — the affected data is excluded from deletion for the duration, the hold is recorded in the operator audit log, and the organisation is told unless the law prevents it. Self-service holds are not yet available.

After account or organisation deletion

See the deletion and export policy for what is removed, what is kept, and the export window before removal.

Changes to this schedule

A new retention window, or a shorter one, is published here with a version number and an effective date at least 30 days before it is enforced, and organisation owners are emailed.