Data Retention

Orithos retention is tier-based: expired scan data is exported to the org owner by email, then purged. Organisations can also switch to Zero-Knowledge mode, in which traces are never stored at all.

Retention windows per plan

Export-then-purge

Before anything is deleted, expired scans, traces, and findings are exported to CSV and emailed to the organisation owner. Only after the export email succeeds is the data purged — if the export fails, the purge is skipped (fail-open) and retried on the next cycle. If email delivery is not configured for your deployment, purging is deferred rather than destroying data silently.

Zero-Knowledge mode

Organisations can switch to Zero-Knowledge retention, in which traces are never persisted in the first place — so there is nothing to purge going forward. Switching to Zero-Knowledge immediately purges all existing stored traces (batched, irreversible) and the change is recorded in the audit log. Findings and scan metadata remain subject to the export-then-purge schedule above.

curl -X PATCH https://api.orithos.com/v1/orgs/{org_id}/settings \
  -H "Authorization: Bearer {admin_key}" \
  -H "Content-Type: application/json" \
  -d '{
  "retention_mode": "zero"
}'

Custom retention windows

Business-tier organisations and above can set a custom retention_days value via the same settings endpoint, overriding the plan default. Custom windows are rejected for lower tiers.

Cleanup jobs

A cleanup job runs on the worker cron schedule (hourly) and purges expired traces per organisation retention tier, skipping orgs in Zero-Knowledge mode. The retention export job follows the same tier windows and handles the email-then-purge flow described above. Both jobs log the number of records purged, and failures are surfaced to the operations channel rather than silently dropped.