CentralCSP
Security

Data retention

Browser reports are kept 90 days, fixed and not configurable. Compliance decisions and audit logs are kept until the account is deleted.

Last update:

Different data has different lifetimes, and only one of them expires.

DataKept for
Browser reports, all 13 types90 days
Aggregated report rollups90 days
Script inventory and review decisionsUntil the account is deleted
Compliance change ledgerUntil the account is deleted
Audit logsUntil the account is deleted

Report retention

This is fixed. It applies to every plan, and there is no setting to change it. Reports older than 90 days are removed automatically.

The 90d option on report pages is therefore the full window. Nothing older exists to query.

Compliance data retention

Your PCI DSS review decisions, their justification text, and the full change ledger are stored separately and are not subject to the 90-day window.

This is deliberate. Evidence that a script was authorized in March needs to survive into an audit in December, long after the hash reports behind it have expired. The evidence pack includes the complete ledger regardless of report age.

Retired scripts, meaning ones no longer matching your payment-page scope, keep their status, justification, and history too.

Delete data yourself

Two actions remove report data ahead of schedule:

  • Reset reports on a website clears its stored reports without resetting usage. For more information, refer to General settings.
  • Delete website removes the site and everything under it.

Neither erases the audit log, and deleting a workspace removes everything it owns.

Next steps

On this page