---
title: "For data protection officers"
description: "What the server holds and never holds, how long each category is kept, and the three workflows a data protection officer asks about."
canonical: https://keepitlocal.app/dpo
last-updated: 2026-09-13
---

# For data protection officers

What the server holds and never holds, how long each category is kept, and the three workflows a data protection officer asks about.

What the server holds, and what it never holds:
- Holds: Account email, display name and avatar. Never holds: Your documents
- Holds: Session records: a token hash, timestamps, user agent, network address. Never holds: Any page image, thumbnail or preview
- Holds: An audit trail of security-relevant actions, including failures. Never holds: Any text a detector matched
- Holds: Export certificates: two checksums, counts, engine version, timestamp. Never holds: The names of your files, unless you publish a report
- Holds: Export counters for plan metering. Never holds: Your redaction marks or their coordinates
- Holds: Shared report metadata, if you share a report. Never holds: Your password, which is held only as an Argon2id hash
- Holds: Early access requests, if you submitted the form. Never holds: Card details, which Paddle holds as merchant of record

How long it is kept:
- Audit rows: 365 days
- Export counters: 400 days
- View log of a shared report: 90 days
- Email delivery records, recipient domain only: 30 days
- Expired sessions, tokens, invitations, permits, rate-limit keys: Next retention sweep
- Account email, name and memberships: Life of the account
- Export certificates: Life of the workspace, see erasure below

The three workflows:
- Subject access request
  The person signs in and takes the download in Settings.
  It is a zip of the account record: profile, sessions, memberships, certificates, published reports and their own audit rows.
  If they cannot sign in, email us and we produce the same record within one month.
- Sharing a document with a vendor
  Open the file and run the leak check, which reports what is hidden in it.
  Sanitize, redact, or both, then export. The file is read back and checked before it is handed over.
  Send the file with its certificate, or share the report behind a password and an expiry.
- Erasure, and what it does to certificates
  Deleting the account removes it with its sessions, its second factor and any workspace only that person owns.
  Certificates in a workspace that continues outlive the account, because evidence that vanishes proves nothing.
  To re-issue, export the file again. A new certificate covers the new bytes, and the old one still verifies.