Data retention
Browser reports are kept 90 days, fixed and not configurable. Compliance decisions and audit logs are kept until the account is deleted.
Last update:
Different data has different lifetimes, and only one of them expires.
| Data | Kept for |
|---|---|
| Browser reports, all 13 types | 90 days |
| Aggregated report rollups | 90 days |
| Script inventory and review decisions | Until the account is deleted |
| Compliance change ledger | Until the account is deleted |
| Audit logs | Until the account is deleted |
Report retention
This is fixed. It applies to every plan, and there is no setting to change it. Reports older than 90 days are removed automatically.
The 90d option on report pages is therefore the full window. Nothing older exists to query.
Compliance data retention
Your PCI DSS review decisions, their justification text, and the full change ledger are stored separately and are not subject to the 90-day window.
This is deliberate. Evidence that a script was authorized in March needs to survive into an audit in December, long after the hash reports behind it have expired. The evidence pack includes the complete ledger regardless of report age.
Retired scripts, meaning ones no longer matching your payment-page scope, keep their status, justification, and history too.
Delete data yourself
Two actions remove report data ahead of schedule:
- Reset reports on a website clears its stored reports without resetting usage. For more information, refer to General settings.
- Delete website removes the site and everything under it.
Neither erases the audit log, and deleting a workspace removes everything it owns.