The schedule
| Data | Default period or criterion | Reason |
|---|---|---|
| Email sign-in codes | 10 minutes or five failed attempts | Authenticate one sign-in. The code is hashed and deleted after successful use. |
| Signed session | 7 days | Keep a user signed in. Signing out removes the browser cookie immediately. |
| Rate-limit counters and pseudonymous source keys | Up to 24 hours | Prevent abuse and diagnose short-lived traffic incidents. Sign-in source addresses are HMAC-pseudonymised before storage. |
| Account, membership and workspace settings | Workspace lifetime | Operate the account and enforce access. Removed from active systems when the workspace is erased, subject to narrow legal records below. |
| Build conversations, packages, skills, configurations and uploaded process documents | Workspace lifetime | Build, explain, version and operate the Customer’s automations. The Customer may export or erase the workspace. |
| Run traces | Customer-configured; workspace lifetime if no window is configured | Investigate what an automation did. A deployment may set RETENTION_TRACE_DAYS. |
| Run summaries | Customer-configured; workspace lifetime if no window is configured | Operations, audit and trend analysis. A deployment may set RETENTION_RUN_DAYS, never shorter than trace retention. |
| Resolved exceptions | Customer-configured; workspace lifetime if no window is configured | Show how failed or escalated work was resolved. Open exceptions do not expire automatically. |
| Usage records | Customer-configured; normally at least 13 months | Quotas, billing reconciliation and year-on-year comparison. |
| Hash-chained audit and legal acceptance receipts | Workspace lifetime | Evidence of changes and authority. Removed from active tenant systems only through full workspace erasure; a minimal non-personal erasure receipt survives. |
| Invoices, payment and tax records | The period required by Swiss accounting, tax and limitation rules | Meet legal obligations and establish or defend claims. Stripe may retain its independent records under its own notice. |
| Backups and provider recovery copies | Provider rotation schedule after active-system deletion | Disaster recovery. They are isolated from ordinary use and are not restored except for a recovery event; legal holds may extend the period. |
How configurable retention works
A hosted or dedicated deployment may configure separate windows for full run traces, run summaries, resolved exceptions and usage records. No history is silently pruned where a window has not been configured. A run summary cannot expire before its trace, open exceptions do not expire automatically, and audit cannot be pruned one entry at a time without invalidating its hash chain.
Customers should choose periods based on their process, statutory recordkeeping, limitation periods, employment or sector rules, and the need to explain automated actions. Shortening a window can permanently remove data as soon as the next retention job runs.
Workspace erasure
Full workspace erasure is separate from routine retention. It clears tenant-scoped active database rows and stored trace objects, including workspace audit and acceptance records. The operation verifies that no tenant rows remain. A minimal erasure receipt survives outside the tenant scope, recording the workspace identifier, counts removed and final audit-chain head rather than Customer content.
Backups and disaster-recovery copies are not available for ordinary use after active deletion and expire under provider rotation schedules. If a recovery temporarily restores deleted data, deletion controls must be reapplied. Narrow tax, billing, legal-hold or security evidence may be retained and isolated for the applicable legal period.
Choosing or asking about a period
Enterprise Order Forms can record a deployment-specific schedule and data-residency design. Contact hello@boundlane.com to request the configured values, discuss a different schedule, or coordinate deletion.