Data Retention

Overview

Triform retains different types of data for varying periods based on product functionality, legal requirements, and user preferences.

Retention periods

Project data

What: Projects, Actions, Agents, Flows, code, configurations

Retention: Indefinite while Project is active

After deletion: 30-day soft delete, then permanent

Purpose: Core product functionality

User control: Delete Projects anytime

Execution data

What: Execution records, inputs, outputs, logs, traces

After period: Execution details deleted, summary statistics retained

Purpose: Debugging, monitoring, compliance

User control: Export before deletion, star important executions for longer retention

Project Variables

What: Configuration values, secrets, API keys

Retention: Indefinite while active

After deletion: Immediate permanent deletion (no soft delete)

Purpose: Application configuration

User control: Delete Variables anytime

Note: Secrets deleted from our systems within 24 hours (key rotation cycle)

API keys

What: API key metadata (not the secret itself)

Retention: Active until revoked or expired

After revocation: 90 days for audit purposes

Purpose: Authentication, audit trails

User control: Revoke anytime

Note: The secret key itself is hashed and cannot be recovered

Audit logs

What: Security events, access logs, changes

Retention: 90 days (standard), 1+ year (Enterprise)

Purpose: Security, compliance, debugging

User control: Export anytime

Compliance: May be required longer for regulated industries

User data

What: Account info, profile, email, preferences

Retention: While account is active

After deletion: 30-day soft delete, then permanent

Purpose: Account management, communication

User control: Delete account anytime

Payment data

What: Billing history, invoices, payment methods

Retention: 7 years

Purpose: Legal/tax requirements, dispute resolution

User control: Cannot be deleted (legal obligation)

Note: We don't store full credit card numbers (tokenized via payment processor)

Analytics data

What: Aggregated usage statistics, performance metrics

Retention: 2 years

Purpose: Product improvement, capacity planning

User control: Anonymized, cannot be deleted

Note: No personally identifiable information

Soft deletion

Some data types use soft deletion for recovery.

How it works

1. Mark as deleted — Data hidden from UI and API
2. Grace period — 30 days to recover
3. Permanent deletion — After grace period

What uses soft deletion

✅ Projects — 30-day recovery window✅ User accounts — 30-day recovery window❌ Project Variables — Immediate deletion (security)❌ API keys — Immediate revocation❌ Executions — Immediate deletion after retention period

Recovery process

Within grace period:

1. Contact support@triform.ai
2. Provide Project/account ID
3. Confirm identity
4. We'll restore within 24 hours

After grace period: Cannot be recovered

Data minimization

We collect and retain only what's necessary.

What we collect

✅ Necessary for service:

• Project code and config
• Execution data for debugging and AI model training (only free community version)
• Account info for authentication
• Billing info for payments

❌ Not collected:

• Personal data beyond account basics
• Tracking cookies (beyond essential)
• Browsing history outside Triform
• Third-party service credentials (unless you provide in Project Variables)

Anonymization

Analytics and training data is anonymized:

• User IDs replaced with random identifiers
• IP addresses hashed
• Names and emails removed
• Aggregated only (no individual tracking)

Geographic data storage

Data residency

Standard: EU-based data centers

Data localization: Customer data stays in EU.

Data transfer

Within region: No cross-border transfer

GDPR compliance: Data stored in EU

Deletion procedures

Deleting Projects

1. Project menu → Delete
2. Confirm by typing Project name
3. Project soft-deleted
4. 30-day recovery window
5. Permanent deletion after

What happens:

• Project removed from UI
• Executions deleted per retention policy
• Audit logs retained

Deleting account

1. Account Settings → Privacy → Delete Account
2. Confirm by typing email
3. Account soft-deleted
4. 30-day recovery window
5. Permanent deletion after

What happens:

• Account deactivated immediately
• Projects you own deleted (after grace period)
• Shared Projects remain (your access removed)
• Payment history retained (legal requirement)
• Audit logs retained (90 days)

Deleting Organization

1. Organization Settings → Delete Organization
2. Requires Admin role
3. Confirm by typing Organization name
4. All Projects deleted
5. All members removed
6. Billing canceled

Cannot delete if:

• You're not the last Admin (transfer ownership first)
• Active subscription (cancel first)
• Recent executions (wait for retention period)

Data breach procedures

If a data breach occurs:

Our response

Within 72 hours:

1. Identify scope and affected data
2. Contain the breach
3. Notify affected users
4. File regulatory reports (if required)

Notification includes:

• What data was affected
• How many users/records
• What we've done to fix it
• What you should do (e.g., rotate keys)

User actions

If notified of a breach:

1. Rotate API keys immediately
2. Update Project Variables (especially secrets)
3. Review audit logs for suspicious activity
4. Enable 2FA if not already
5. Monitor for unusual activity

Compliance

GDPR (EU)

Rights you have:

• Access: Request copy of your data
• Rectification: Correct inaccurate data
• Erasure: "Right to be forgotten"
• Portability: Export in machine-readable format
• Object: Object to processing

Exercise rights: Account Settings → Privacy or email privacy@triform.ai

Other regulations

We comply with applicable data protection laws in EU.

FAQs

Q: Can I extend execution retention?A: Enterprise plans offer custom retention. Contact sales.

Q: What happens to my data if Triform shuts down?A: We'll provide at least 90 days notice and export tools.

Q: Are backups deleted too?A: Yes, backups are deleted per the same schedule.

Q: Can I request early deletion?A: Yes, contact support for manual deletion requests.

Q: Is deleted data truly unrecoverable?A: After permanent deletion, yes. We use secure deletion methods.

Contact

Data requests: privacy@triform.aiSecurity concerns: security@triform.aiGeneral support: support@triform.ai

Response time: 5 business days for data requests, 24 hours for security issues

Related

Continue exploring the security documentation to learn about compliance and data protection measures.