Data retention

Pause vs delete

Deep sleep is a pause with the disk moved to a snapshot; deleting a box in deep sleep erases that snapshot and leaves no undo copy. Disks and snapshots are encrypted at rest (Security and trust).

Deleting a box

A deleted box's last state is kept 7 days as a snapshot named deleted-<box>-<date>, under Recently deleted on the Deleted tab of Dashboard → Boxes.

• None for a box deleted within an hour of being created: its contents came from its image, snapshot, or source box.
• Undo a delete by restoring the snapshot: a new box with the disk as it was, under the old name if nothing else took it. Restoring renews the copy's 7 days.
• It does not count toward the 20 snapshots you can keep.
• Remove it sooner. Delete now on the row removes the copy at once; zero data retention removes every copy and stops new ones.

A delete removes the machine, its disk, its tunnel and SSH identity, any phone access password, and its command history right away; what stays is under Records retained after deletion.

Deletion operations

Every delete returns an operation you can poll.

curl -X DELETE -H "Authorization: Bearer $PRIZED_API_KEY" https://prized.dev/api/v1/boxes/<box-id>
# {"box":{...},"operation":{"id":"dop_…","kind":"box_delete","status":"pending",...}}

curl -H "Authorization: Bearer $PRIZED_API_KEY" https://prized.dev/api/v1/operations/dop_…
# {"operation":{"id":"dop_…","kind":"box_delete","status":"completed","completedAt":"…"}}

status is pending, processing, completed (for a box, once it reads terminated), or failed with error (rare, and worth a support message). DELETE /api/v1/snapshots/<id> answers the same way with kind: "snapshot_delete". Deleting something already being deleted returns the same operation, and finished operations stay readable for 30 days.

From the CLI, prized ops status <id> prints one and --wait polls it. Every route is on the API reference.

Zero data retention

Dashboard → Settings → Data and privacy, owner only (no API key can switch it), on custom plans. On a self-serve rung or the free credit, Talk to us (a short form we answer by email) replaces the switch, and the API answers 403 plan_required. Turning it on asks you to type exactly delete deleted box data; turning it off asks nothing and works on any plan.

With it on:

• A deleted box leaves no final snapshot, so a delete cannot be undone; earlier copies are removed at once. Prized's disaster-recovery backups are not affected and each ages out within a week (see below).
• Metrics are kept 24 hours instead of 30 days, and the Metrics page stores no process or port history (what it stored is deleted).
• Snapshots you take yourself are untouched.
• The audit log keeps every row for its full window, but exec, file.upload, file.download, and prompt rows are written with no detail (no detail kept (zero data retention)).
• Command history keeps that a command ran, who ran it, when, how it ended, and how many bytes it printed, but no command line, directory, or output; turning it on deletes those from existing records.

Closing a workspace

Dashboard → Settings → Data and privacy → Close workspace, owner only, confirmed by typing the workspace's name. At once:

• The plan is canceled. Credit in the balance stays but is not refunded.
• Every box is paused; disks are kept.
• Every API key, install link, and phone access password is revoked. Your own dashboard sign-in stays, so invoices stay readable and you can reopen.
• Other members are removed, the invite link stops working, and domain auto-join is switched off.
• You get one email naming the deletion date.

Nothing is deleted for 30 days; a banner names the date. Reopen clears the close: boxes stay paused until you start them, you pick a plan again, and auto-join stays off until you switch it back on. Until you reopen, no box can start or wake and no plan can be bought or changed.

Erase now, below Close, skips the window: it terminates every box and disk; deletes every snapshot, secret, environment, and token, the audit log, and policies; cancels the plan (any overage owed bills on a final invoice, as for any cancelled plan); removes the billing account from Stripe; and signs you out for good. There is no undo.

Records retained after deletion

Deleting a box or a snapshot removes the machine, the disk, and the storage; the box's event history, its ledger usage, and the audit rows that name it stay in the workspace until the workspace is erased.

Erasing the workspace (Erase now, or 30 days after a close) deletes everything in it: boxes, disks, snapshots, secrets, environments, tokens, members, the ledger, hourly usage, event history, command history, audit log, policies, and CLI usage aggregates. What remains:

• Invoices and payment records at Stripe, as required for tax and accounting. Prized keeps no copy of your ledger.
• Sign-in identity history: which provider account (Google or GitHub) signed in as which user, so a reassigned or recreated mailbox cannot inherit a deleted account's standing.
• Abuse records: if a computer signed in to several new workspaces, its key fingerprint and those workspaces' identifiers. The 90 days run from when we last added a workspace to that computer's record, which we do when the pattern is detected (within minutes of the use that completes it; the uses it counts can be up to a day older), and the record is deleted in the hourly cleanup after that. Adding a workspace restarts the 90 days for the whole record, including workspaces erased since. A workspace held because of it keeps the same data in its hold record for 90 days after the latest use of that computer's sign-ins the hold counted, also deleted in the hourly cleanup after that.
• Fleet-level aggregate telemetry: counts describing the fleet as a whole, with no per-customer identity.
• Disaster-recovery backups of box disks, for up to a week after the disk is gone: a rolling week of encrypted backups of every box disk, kept to recover from a platform failure. You cannot see them, and no customer action removes them early.

Telemetry retention windows