Data retention and your control
FindSignal keeps scan data only as long as it is needed to show you results. Old data is deleted by a scheduled job every day.
How long we keep it
| Data | Kept for |
|---|---|
| Audits, findings, tasks and saved reports | 365 days, or your plan's history period if shorter (free plan: 30 days) |
| Text and structure extracted from crawled pages (evidence) | 90 days; findings stay, their page detail is dropped |
| Public demo scans | 7 days |
| Security log (sign-ins to connected apps, admin actions; IP addresses kept only as a keyed hash) | 365 days |
| Application logs | 30 days |
| Usage records (audit counts for plan limits) | [placeholder: period to be set after legal review] |
| A deleted workspace | Removed at once; backup copies age out within 30 days |
We do not store full page HTML, images, cookies or anything behind a login. The crawler only fetches public pages; see about our crawler.
If you are a customer
- Workspace owners and admins can delete any finished audit, with its pages, findings, tasks and reports, from the audit page.
- To delete a whole workspace and everything in it, contact support.
- Connected apps such as ChatGPT can be disconnected at any time under Connected apps.
If you own a website that was scanned
Anyone can start an audit of a public website, so your site may have been scanned by someone else. A scan reads public pages only. Scanning a site does not give the person who ran it, or FindSignal, any permission to access, change or log in to that website or any of its private resources, and FindSignal never attempts to.
- To stop all future scans, block the crawler in robots.txt (
User-agent: FindSignalBot/Disallow: /). It is checked before every audit. - To have your site blocked on our side, and stored scan data about it deleted, contact us from an address at that domain, or show control in another way we can check. We block the host and delete its scan data from every workspace.