Data retention policy
WethosAI's Data retention policy is in accordance with SOC2 compliance requirements
Data Retention Policy
Wethos AI
____________________________________________________________________________
1. Purpose
This policy outlines the requirements, controls, and procedures that Wethos AI has implemented to manage the retention, protection, and deletion of data. It operates in conjunction with the existing Data Protection Policy, Data Classification Policy, and Information Security Policy.
2. Policy
2.2 For Customers
Active Accounts
Customer data is retained for as long as the account remains active and in good standing.
Voluntarily Closed Accounts
When a customer voluntarily closes their account, all data related to the account will be retained for 30 days. After this period, the account and its associated data will be completely anonymized.
Data Retrieval for Closed Accounts
Customers with closed accounts must bring their accounts back into good standing to access their data. If the account remains unresolved for 30 days, the data will enter an “expired” state, and permanent deletion will occur 30 days later unless otherwise required by law.
2.3 Data Security & Confidentiality
Access Controls
As outlined in the Information Security Policy, Wethos AI enforces strict access control measures to ensure that only authorized personnel can access sensitive customer data. Access permissions are regularly reviewed and logged for auditing purposes. All sensitive access controls have mandatory MFA authentication control.
Encryption
In line with the Data Protection Policy, all customer data is encrypted in transit and at rest, ensuring confidentiality and integrity throughout its lifecycle.
2.4 Secure Disposal or Reuse of Equipment
Internal Data Disposal
Before any equipment containing sensitive data is disposed of or reused, Wethos AI will securely erase all data through approved methods such as cryptographic erasure or secure overwriting.
Cloud Service Provider Responsibilities
Wethos AI adheres to all service-level agreements (SLAs) with Cloud Service Providers when it comes to data deletion and disposal.
2.5 Audit Logging & Monitoring
Logging of Data Access and Changes
All access to customer data is logged, as specified in the Information Security Policy. Logs include timestamped records of who accessed or modified data, and they are retained for 90 days for auditing and incident investigation.
Monitoring Systems
Wethos AI uses New Relic to monitor system activity. We also maintain logs of all system access and changes across our cloud infrastructure in cloud logging. In addition, system logs are tracked locally within the cluster for redundancy and further analysis. Logs from both sources are securely stored and reviewed periodically by the Security Lead to detect any potential anomalies or security incidents. Alerts are configured to notify key personnel immediately in the event of system failures, or other incidents requiring intervention.
2.6 Protection of Records
Record Security
All customer records within Wethos AI are protected using measures that include encryption, access controls, and regular audits to ensure integrity and security.
Cloud Service Provider Oversight
Wethos AI verifies that its cloud service providers have appropriate security measures in place for protecting records as stated by their SLAs.
Data Retention Schedule-
Corporate Records are stored in Google Drive, 5 year retention period
Employee Personnel Records are stored in Gusto, 3 year post termination retention period
Employment Contracts are stored in Gusto, 3 year post termination retention period
Production System Logs are stored in AWS and New Relic, 90 day retention period
Customer Data is stored in AWS, 30 day post account closure retention period
Data archiving and removal policy
WethosAI will remove data in accordance with SOC2 compliance requirements and SLAs with Cloud Service Providers
4.5 Data Retention and Deletion
Data is retained for the minimum period necessary to fulfill business, legal, or regulatory obligations. The Wethos AI Data Retention Policy governs retention periods for different types of data (e.g., logs, customer records, and backups).
Once data is no longer required, it is securely deleted using methods appropriate for the medium, such as data wiping for electronic files and shredding for hard-copy materials.
Wethos AI follows the principle of data minimization, collecting and retaining only the necessary data for business and legal purposes. Unnecessary or obsolete data is regularly purged in compliance with the Data Retention Policy to reduce the risk of overexposure.
2.4 Secure Disposal or Reuse of Equipment
Internal Data Disposal
Before any equipment containing sensitive data is disposed of or reused, Wethos AI will securely erase all data through approved methods such as cryptographic erasure or secure overwriting.
Cloud Service Provider Responsibilities
Wethos AI adheres to all service-level agreements (SLAs) with Cloud Service Providers when it comes to data deletion and disposal.
Data storage policy
WethosAI will store customer data in accordance with their Data retention policy, and SOC2 compliance requirements.
2.5 Audit Logging & Monitoring
Logging of Data Access and Changes
All access to customer data is logged, as specified in the Information Security Policy. Logs include timestamped records of who accessed or modified data, and they are retained for 90 days for auditing and incident investigation.
Monitoring Systems
Wethos AI uses New Relic to monitor system activity. We also maintain logs of all system access and changes across our cloud infrastructure in cloud logging. In addition, system logs are tracked locally within the cluster for redundancy and further analysis. Logs from both sources are securely stored and reviewed periodically by the Security Lead to detect any potential anomalies or security incidents. Alerts are configured to notify key personnel immediately in the event of system failures, or other incidents requiring intervention.
2.6 Protection of Records
Record Security
All customer records within Wethos AI are protected using measures that include encryption, access controls, and regular audits to ensure integrity and security.
Cloud Service Provider Oversight
Wethos AI verifies that its cloud service providers have appropriate security measures in place for protecting records as stated by their SLAs.
Data center location(s)
United States
Data hosting details
All data is Cloud Hosted
App/service has sub-processors
no
App/service uses large language models (LLM)
yes
LLM model(s) used
Gemini 2.5 Pro and Flash, Gemini 3 Flash, Gemini 3.1 Pro
LLM retention settings
To help with abuse monitoring, Google retains the following data for fifty-five (55) days:
Prompts: The text prompts you submit to the API.
Contextual Information: Any additional context you provide with your prompts.
Output: The responses generated.
LLM data tenancy policy
Google's enterprise-grade security applies to Gemini services as well.
Your content is not used for any other customers. Your content is not human reviewed or used for Generative AI model training outside your domain without permission.
LLM data residency policy
Data stored at rest in the customer selected location remains at rest in that location, independent of the Generative AI on Vertex AI endpoint called by that customer's request.
WethosAI uses the us-central1 (Iowa) cloud region.