docs · deletion
What we delete, and when
We keep the minimum needed to run the job and prove we did. Everything else is deleted on a schedule you can read here and check on the receipt.
Schedule#
| data | where it lives | deleted |
|---|---|---|
| Input files | Encrypted staging in the region that runs the job | When the job finishes, or on cancel |
| Model weights you upload | Encrypted staging next to the GPUs | When the job finishes; cached copies within 24 hours |
| Outputs | Encrypted staging until your bucket confirms each object | On confirmation; 72 hours at the latest (deletion_at on the receipt) |
| Prompts and completions in logs | Never written to logs | Not applicable |
| Operational logs | Token counts, timings, placement, errors | 13 months |
| Receipts | Your bucket and our ledger; redacted copy at /receipts | Kept: they are the record of what you paid |
| Account and billing | Billing system | 7 years after exit, as tax law requires |
| API keys | Hashed | On revoke or exit |
How to check#
Each receipt carries deletion_at. Each staging bucket has a lifecycle rule that enforces it, and the rule's configuration is part of our SOC 2 evidence.
Ask for a deletion certificate for any job id and we send the storage provider's delete event log for its objects.