Data Retention & Deletion Policy
1. Purpose
This policy covers two related but distinct things: how long we retain your account data after you stop using AetherCloud, and how long we retain system backups for disaster recovery. They're governed by different requirements and different timeframes.
2. Account data retention
This is covered in full in our Privacy Policy, §7. In summary: account data is retained for the life of your account plus 30 days after deletion (to allow for accidental-deletion recovery), billing audit rows (transaction and subscription records — a separate system from the vault activity log covered in §4 below) relevant to tax and financial recordkeeping are retained for 7 years, and IP addresses are rotated out of logs within 24 hours.
3. System backup retention
Independently of account-level data retention, we maintain encrypted system backups for disaster-recovery purposes:
| System | Backup cadence | Retention window |
|---|---|---|
| Primary database | Daily | 14 days |
| Application file storage | Daily | 7 days |
| Vault object storage | Daily | Rolling |
Backups are encrypted at rest and stored offsite from the primary infrastructure they back up. Backup restoration is verified on a monthly cadence.
4. Audit log integrity
Protocol-C's cryptographic audit trail (the vault activity log — a separate system from the billing audit rows in §2 above) is viewable by the vault owner via the audit endpoint and is append-only: hash-chained, so historical entries cannot be silently altered. Entries are retained in full today, with no automated expiry. A checkpoint-hash mechanism already exists so that a future archive-and-purge process can move aged entries to durable object storage while still letting the remaining chain be verified against the last archived checkpoint; that automated archival step is planned but not yet built. See our Trust page for how this maps to SOC 2 criteria.
5. Deletion on request
You can request full account deletion at any time from your account settings or by contacting us. Deletion propagates across our systems within 30 days, with the narrow exceptions noted above (billing records we're legally required to retain).