Data handling

About a workspace

Accounts, members, roles, invitations, clients and their contacts, packages, API keys (encrypted), subscriptions and orders where billing applies, and the workspace's storage configuration (credentials encrypted).

About a site

• Its address, name, client, package and settings.
• The inventory it reported: plugins, themes, users, core version, health, environment — kept current over both channels, with the age of each dataset recorded.
• Update rounds: what was updated, what was backed up first, what the checks found, what was rolled back, with the site's own reasons where an update was refused.
• Backups: the list of pieces of each, where each copy is and whether it was verified, and — for a storage policy that keeps an external copy — the backup itself in the workspace's object storage.
• Monitoring: the checks and their log for ninety days.
• Reports: Lighthouse results and thumbnails, where enabled.
• Health: what the platform found each time it could not reach the site, and when the site last called in.
• Notes a member wrote about the site.

What the platform does not keep

• The site's content, other than inside a backup the workspace asked for.
• Any storage credential on the site.
• Secrets in logs or audit records. A secret that must reach a person is shown as a fingerprint.

Retention

Monitor logs are removed after ninety days. Backups are kept according to the workspace's storage policy and the retention the package sets; the platform never deletes a backup on a site or in storage as a side effect of checking its records — a leftover is a finding for a separate decision. Those checks run hourly and after every backup, restore and delete, and correct the platform's records to what the site and the storage actually hold, never the reverse.

Where it runs

The platform runs in the European Union. Backups go to the object-storage bucket the workspace configures, in the region that bucket is in.