Data retention policy
The company shall retain data as long as the company has a need for its use or to meet regulatory or contractual requirements. Once data is no longer needed, it shall be securely disposed of or archived. Data owners, in consultation with security leadership and/or legal counsel, may determine retention periods for their data.
Personally identifiable information (PII) shall be deleted or de-identified when it no longer has a business use.
Data archiving and removal policy
Data Removal & Disposal
Secure Deletion: Data classified as Restricted or Confidential must be securely deleted when it is no longer needed for business, regulatory, or contractual purposes.
Hardcopy Disposal: Confidential and Restricted physical materials must be shredded or disposed of using other secure methods.
Customer Data: Customer accounts and data are manually deleted within 90 days of contract termination.
Device Clearing: Company devices (laptops, etc.) are collected from terminated employees and securely wiped before being re-provisioned or removed from inventory.
Data Archival
ISMS Documents: Approved documents that have reached the end of their useful life are stored in an archive within Vanta to maintain an audit trail of document development.
Archived Records: General ISMS records (such as risk reports or audit artifacts) that are no longer in active use are moved to a separate archive and maintained for at least one (1) year before disposal.
Security Policies: Archived security policies are retained for one (1) year after they are archived, as specified in the Data Retention Matrix.
Legal Holds
If the organization becomes subject to legal proceedings, any associated data is placed on a legal hold and is exempt from standard disposal requirements until the Legal department provides further instruction. These holds are reviewed annually.
Data storage policy
Storage & Protection Requirements
Encryption at Rest: All data classified as Confidential (including customer data, PII, and source code) must be encrypted at rest using strong cryptographic algorithms (e.g., AES-256).
Endpoint Storage: Laptops and mobile device hard drives must be encrypted. Devices are also configured to automatically lock the screen after 15 minutes of inactivity.
No Removable Media: Storing confidential data on removable media (USB drives, CDs, etc.) is strictly prohibited. Any exception requires explicit approval and the media must be encrypted.
Cloud Storage: You are expected to store critical files in company-sanctioned file storage repositories rather than on local user devices, as the company does not regularly back up individual laptops.
Backup Storage
Location Separation: Backups must be stored in a separate location from production data. This is typically achieved using the native backup capabilities of your cloud infrastructure providers.
Encryption: All backups containing Confidential data must be encrypted.
Testing: Backup restore tests must be performed at least annually to validate both the data and the restore process.
Logging: Any restoration of production data containing PII must be logged or tracked via auditable tickets.
Physical Storage
Paper Records: Hardcopy records of confidential data should be avoided. When they are necessary, they must be labeled "confidential," stored securely, and shredded when no longer needed.
Third-Party Vendors: Only third-party vendors who meet the company's requirements for secure data storage and disposal are used for processing restricted or confidential information.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
Anthropic and OpenAI Models
LLM retention settings
Auctor has ZDR with all of our model providers.
LLM data tenancy policy
Auctor's LLM operates in the EU and US depending on customer regional preferences.
LLM data residency policy
Auctor's LLM stores data in the EU and US depending on customer regional preferences.