Data retention policy
TierZero retains data only as long as it is needed for business, legal, or contractual purposes. Personally identifiable information (PII) is deleted or de-identified when no longer necessary, and customers’ data is deleted within 90 days of contract termination. Security event data is kept indefinitely if on-prem, or for one year if in the cloud. Support data, QA/testing results, and sales records are generally retained indefinitely. Vulnerability scan data is kept for 6 months, and asset data is retained until purged from tools.
Once data is no longer needed, it is securely deleted or archived in line with classification and sensitivity. Devices and media storing confidential or restricted data are securely wiped or destroyed per NIST SP 800-88 guidelines. Retention practices are reviewed annually to ensure compliance with internal policies and regulatory requirements.
Data archiving and removal policy
TierZero archives or removes data based on business need, data classification, and applicable legal or contractual requirements. Data that is no longer actively used but still required may be archived securely; otherwise, it is scheduled for deletion. Customer data is removed within 90 days of contract termination, while PII is deleted or de-identified when no longer needed. Vulnerability scan data is removed after 6 months, and security logs from cloud systems are retained for one year before removal. Support, QA, and sales data are generally not removed unless explicitly required.
For removal, confidential and restricted data is securely deleted using approved methods, and devices are wiped or destroyed per NIST SP 800-88 standards. Paper records are shredded or securely disposed of. Archival and deletion activities are reviewed annually, and only third-party vendors meeting TierZero’s data disposal standards are authorized for handling sensitive data.
Data storage policy
TierZero’s data storage policy ensures that data is stored securely and in accordance with its classification. Confidential data (e.g., customer data, PII, credentials) must be encrypted at rest and in transit using strong, industry-standard cryptographic methods. This data may not be stored on personal devices, removable media, or mobile devices without explicit approval. Access is restricted to authorized personnel on a need-to-know basis, and all systems must enforce authentication and encryption requirements.
Data must be stored in designated, company-approved systems such as secure cloud services or managed infrastructure. Backups of confidential data are encrypted and stored separately from production systems. Temporary or local storage (e.g., on employee laptops) is discouraged, and employees are required to use centralized storage systems like approved file shares to ensure availability and recovery.
Data center location(s)
United States
Data hosting details
Everything is in AWS
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
Anthropic Sonnet, Anthropic Opus, Open AI o4-mini, Google Gemini 2.5 Pro
LLM retention settings
We require that LLM-related data be retained only as long as necessary for business or legal purposes, after which it must be securely deleted or archived in accordance with our data classification and retention policies
LLM data tenancy policy
We mandate that all LLM-related data be stored, accessed, and processed only within approved, secure environments that meet our confidentiality, access control, and encryption standards
LLM data residency policy
We require that any LLM-related data, especially confidential or customer data, must reside within approved geographic regions in compliance with contractual, legal, and regulatory requirements