How your data is used and kept
What this console keeps about the people who sign in to it, for how long, and what you can do about it.
What it keeps
Your name, email, job title and role, given when you're invited. Your password as a one-way hash, and your authenticator encrypted. When you sign in: your browser, your network address and the time. What you do here, in an activity record.
Why
To sign you in, to show you where you're signed in, to tell you about sign-ins from a new network, to slow down password guessing, and to show who did what.
How long
| What | Kept | Why |
|---|---|---|
| Your account: name, email, job title, role, photo and display choices | Until your account is deleted | To sign you in and show who did what. |
| Your password and authenticator | Until your account is deleted or your sign-in is reset | Kept only as a one-way hash (password) or encrypted (authenticator), to check it's you. |
| Where you're signed in: browser, network address and times | 30 days, or less once it ends | To show you your sign-ins and let you end one. Removed each night. |
| Failed sign-in attempts, by network address | 1 day | To slow down password guessing. |
| The network address of your last sign-in | Until your account is deleted | To tell you when you sign in from a new network. |
| The activity record: who did what, when, and from which network address | As long as the service runs | Each entry is chained to the one before, so none can be changed or removed. After your account is deleted, its entries still hold your email; the pages show a stand-in name instead. |
| A count of your recent assistant questions, invites, uploads and report links | 2 days, removed the next time anyone does one | To limit how many each person and each portal can do in a day. |
| Raw answers from connected tools | 90 days; the newest read of each tool is kept | What each read found stays after that; the raw answer goes. |
| Files people upload | Until someone deletes them | They're part of the work. |
| Daily backups of everything above | The newest 14 on the server; any off-site copies until removed by hand | To restore the service after a failure. An off-site copy is made only where one is set up, and nothing removes it. |
What you can do
Download a copy of what's kept about you, from Your data on your profile.
Ask for your account to be deleted, from the same place. The console's Owners decide. When they delete it, your name, email, title, photo, password, authenticator and sign-in records are cleared, and you can't sign in again. The activity record keeps its entries, with your email in them; pages show a stand-in name instead.
One limit
While the service is working on your sign-in, secrets are briefly in the server's memory, and the language it's written in can't wipe them from there on demand.