Your brain lives as long as your account. Delete your company and the records are gone from our database within 30 days; backups outliving that hold ciphertext we no longer have the key for.
Life of the account
Deleted within 30 days of request.
Life of the record
Created and deleted with the record it came from.
180 days
Deleted on a lifecycle rule, or immediately on disconnect. Slack is never copied.
12 months
Distinct versions only.
Life of the account
Deleted within 30 days of request.
30 days after disconnect
The authorization is revoked at disconnect, not 30 days later.
24 hours
Addresses and IPs stored as keyed hashes.
7 years
Required by Canadian tax law.
12 months
Metadata only. No titles, search terms or record ids.
30 days
Hold no customer content.
12 months
Ours, not yours.
0 to 30 days
Held at the provider. Never used for training. See AI and your data.
35 days
Unreadable after key destruction. A deletion is never replayed into a restore.
Each figure is a maximum. Deletion runs automatically on a schedule.
Three ways data leaves
Forget it
Unfindable immediately. A record read from a tool is hidden rather than deleted, so re-reading the tool does not bring it back. A record your AI wrote is deleted outright.
Disconnect it
Reading stops and the authorization is revoked at the source immediately. Raw originals for that tool go straight away. You choose whether the records built from them stay.
Delete the company
Connections revoked, storage prefix emptied, every row removed in one transaction, then the company's encryption key destroyed. Within 30 days, usually same day.
What a backup still holds
Automated snapshots are kept for 35 days, restored only after a serious outage. A deletion is never replayed into a restore.
Your content is encrypted under a key belonging to your company alone, and deleting the company destroys that key. A snapshot taken before that is ciphertext nobody can open, us included.
Shorter, longer, or certified
A shorter ceiling on any row can usually be agreed in the order form. Written confirmation that a deletion completed is available on request. Either at privacy@apex.host. The contractual version of this page is the return and deletion section of the DPA.