Data Retention Schedule
This schedule sets out how long we keep each kind of data held for your organisation, and what happens to it when your workspace ends. It gives the periods behind §8 of our Data Processing Agreement. Where your organisation has a signed agreement with different terms, that agreement prevails.
1. Schedule
| Data | What it holds | Where | Retention |
|---|---|---|---|
| Workspace content and workflow records | Opportunity reviews, qualifications and go/no-go decisions, pursuits and tasks, requirement and criterion reviews, drafts, questionnaires, compliance matrices, comments and approvals, the content library, capability claims, CRM links and settings | Primary database (Neon, United States) | For as long as the workspace exists. Deleted from live systems within 30 days of termination |
| Uploaded and generated documents | Solicitation packs, content-library source files, questionnaire files and their exports, submission packages | Object storage (Cloudflare R2, United States) | As for workspace content |
| User accounts | Name, email address, role, sign-in settings | Primary database | While the person is a member. Accounts that belong to no other workspace are deleted with the workspace |
| Questions asked of the in-app Guide | The question, the screen it was asked from, and the answer. Before storing, each name, title, description or note of four characters or more that was read from your records to answer the question is replaced, wherever it appears word for word in the question or the answer, by a placeholder naming the field. A value the answer words differently is not replaced, and other text the user typed is stored as typed. Readable by BidAngel platform administrators, and not by other members of the workspace | Primary database | 180 days from the question, then deleted automatically. Deleted sooner if the workspace is deleted |
| Audit records | Who did what, when, and to which record | Primary database, and a write-once archive (AWS S3, us-east-1) | 7 years from the date of the event. Not deletable before then — see section 4 |
| Backups | Full copies of the database and of uploaded documents | Neon and AWS S3, both us-east-1 | Expire on a rolling schedule. Deleted data is gone from every backup within 37 days of its deletion from live systems |
| Application logs | Operational events and errors, including the path of a failing request. Not request bodies | Fly.io | About 7 days |
| Error reports | Error messages and stack traces, and the path of the failing request or page. Credentials, cookies, IP addresses, request bodies, query strings and email addresses are removed before the report leaves our systems | Sentry (United States) | Up to 90 days |
| Website visit measurements | Pages viewed on the public website and the sign-in and sign-up pages, with the time, the host name of the referring site and, where an emailed link carried one, an outreach code. No names, email addresses, IP addresses or user-agents | Primary database | 12 months |
| Transactional email records | Recipient, subject and body of the emails the platform sends | Resend | 30 days |
| Export archives | A copy of your workspace we produce at your request | Encrypted, until handed over to you | Deleted within 7 days of your confirming receipt, and at most 30 days after it was produced |
| Uptime monitoring | Results of availability checks against our public endpoints. No customer data | UptimeRobot | 12 months |
2. While your workspace is active
We do not delete your content on an age-based schedule: it stays until your users delete it or the workspace ends. Records your users delete are removed from live systems at once and leave backups within 37 days; records they archive are kept.
Your organisation can ask for an export of its workspace at any time by writing to [email protected]. Once we have verified that the requester is authorised, we target delivery within 10 business days, unless a documented security, technical or legal impediment requires more time; we will tell you of a material delay. Exports are produced by an operator; a self-service export is not yet available.
The export is a zip archive: the records your workspace owns, as JSON and as CSV, the original files, and a manifest giving each file’s row count and SHA-256 so you can check nothing was altered. It includes your workspace’s own audit trail. It does not include questions asked of the in-app Guide, search indexes derived from your content, or stored credential secrets.
3. When your workspace ends
- For 30 days after termination your organisation can make a verified, authorised request for a final export.
- A request received within that window is not defeated by routine deletion from live systems. Where necessary, we keep a restricted, encrypted copy of only the data needed to complete the export, and delete it once the export is delivered or a documented exceptional impediment ends.
- We target delivery within 10 business days of verifying the request, subject to the exceptions in section 2. This is a delivery target, not a promise that a third-party service failure or a legal restriction cannot cause delay.
- Within 30 days of termination we delete your workspace content, documents and the accounts that belong only to your workspace from live systems, except for the limited copy kept to complete a timely export request, data we are legally required to preserve, and the audit records described in section 4. Ask and we will delete sooner.
- Copies in backups are not deleted one by one. They expire with the backups, within 37 days of deletion from live systems.
- We then confirm in writing what was deleted and when, which backups still hold copies and the date they expire, which audit records we retain and why, and any exceptional preservation and its justification.
Published procurement notices and buyer records are shared market data that we hold for every customer. They were never your organisation’s data and are not deleted when you leave; your records’ references to them are.
4. Audit records and deletion
Audit records are kept for 7 years because their value as evidence depends on nobody, including us, being able to remove records selectively. The archive copy is written to storage locked in compliance mode: no account, ours included, can delete a record or shorten its retention before the 7 years have passed.
An audit record names the person who acted and the record acted on, so it can contain personal data after the rest of a workspace has been deleted. Where a deletion request reaches personal data in audit records, we keep the records, use them only to demonstrate compliance and to establish or defend legal claims, and tell you which records are retained and why, as §8 of the DPA commits. They are deleted when their 7 years end.
5. Changes
We publish changes to this schedule here, with a new version date. If a change would shorten the time you have to export your data or lengthen how long we keep it, we will tell your organisation before it takes effect.