Data Retention Policy
Last updated: April 2026
Overview
Cloud Cost Analyzer (CCA) retains your data only as long as necessary to provide the service and meet legal obligations. This document describes what data we store, how long we keep it, and how deletion works.
Raw cloud data is never stored. When you run a scan, your resource metadata, utilization metrics, and cost records are transmitted for analysis and immediately discarded. Only optimization findings and aggregate statistics are persisted.
Retention Schedule
| Data Category | Community (Free) | Professional | Enterprise | After Account Deletion |
|---|---|---|---|---|
| Account data (email, name, org) | Life of account | Life of account | Life of account | 30 days |
| API keys (SHA-256 hashed) | Until revoked | Until revoked | Until revoked | Immediate |
| Scan results & findings | 90 days or 10 most recent | 1 year | 2 years | 30 days |
| Executive summaries | Same as scans | Same as scans | Same as scans | 30 days |
| Raw cloud resources | Not stored | Not stored | Not stored | N/A |
| Utilization metrics | Not stored | Not stored | Not stored | N/A |
| Cost records | Not stored | Not stored | Not stored | N/A |
| Billing & subscription events | 7 years | 7 years | 7 years | 7 years (legal) |
| Audit logs | 1 year | 1 year | 1 year | 1 year |
| Team invitations | 30 days after expiry | 30 days after expiry | 30 days after expiry | Immediate |
What We Store vs. Discard
Stored (persisted to database)
- Optimization findings — Resource IDs, category, severity, estimated savings, recommendation text, supporting evidence (metric summaries and thresholds)
- Scan summaries — Total resources scanned, total findings, aggregate savings, optimization score, providers and regions
- Account data — Email, name, organization, hashed password, subscription state
- API keys — SHA-256 hashed (never stored in plaintext), with metadata and usage timestamps
Discarded immediately after analysis
- Raw cloud resources — Full resource metadata, tags, and configuration details
- Utilization metrics — CloudWatch time-series data (CPU, memory, network, disk)
- Cost records — Individual cost line items from AWS Cost Explorer
- Scan configuration — Provider credentials, region lists, service filters
In air-gapped (offline) mode, no data is ever transmitted to or stored on our servers. All analysis happens locally. This policy applies only to managed mode.
Automatic Cleanup
The system automatically enforces retention limits:
- Community tier: Only the 10 most recent scans are retained. Older scans are deleted when new scans are submitted.
- Professional tier: Scans older than 1 year are automatically purged.
- Enterprise tier: Scans older than 2 years are automatically purged.
- Expired API keys: Cleaned up 30 days after expiration.
- Team invitations: Expired invitations are removed after 30 days.
Cleanup runs as a background process and does not affect service availability.
Right to Deletion
You can request deletion of your data at any time under GDPR (Article 17) or CCPA.
Account deletion process
- Request: Delete your account via Settings > Delete Account, or email privacy@dragonfractal.com
- Immediate: Account is deactivated, all sessions and tokens are revoked
- Within 30 days: All personal data, scan results, findings, API keys, and team memberships are permanently deleted
- Retained: Anonymized aggregate statistics may be kept for internal analytics. Billing records are retained for 7 years per legal requirements.
Individual scan deletion
Delete individual scans at any time via the dashboard or API (DELETE /api/v1/scans/{id}). All associated findings and evidence are permanently removed via cascading delete.
Data export
Professional and Enterprise subscribers can export scan data in JSON format via the dashboard or API (GET /api/v1/scans/{id}/export/json), supporting GDPR data portability (Article 20).
Regulatory Compliance
GDPR
Retention periods comply with the storage limitation principle (Article 5(1)(e)). Personal data is retained only as long as necessary. Right to erasure requests are fulfilled within 30 days. Data processing agreements (DPAs) are available for Enterprise customers.
CCPA
California residents can request deletion of personal information. We respond within 45 days. We do not sell personal information.
Security Controls
Our retention policy is documented and enforced as part of our security controls. Audit logs are retained for a minimum of 1 year. Automated cleanup ensures secure disposal when retention periods expire.
Financial Records
Billing records and subscription events are retained for 7 years to comply with tax and financial reporting obligations, even after account deletion.
Changes
Material changes to this policy will be communicated via email or dashboard notification. See also: Privacy Policy | Security
Contact
Questions or deletion requests: privacy@dragonfractal.com