Data retention.

Pause vs delete

Deep sleep is a pause that moves the disk to a snapshot; nothing here changes it, except that deleting a box while it is in deep sleep erases that snapshot and leaves no undo copy — there is no disk attached to take a final snapshot of. Disks and snapshots are encrypted at rest (Security and trust).

Deleting a box

Deleting a box terminates the machine and erases its disk. Its last state is kept for 7 days as a snapshot named deleted-<box>-<date> under Recently deleted on Dashboard → Snapshots.

• Undo a delete. Restore the snapshot: the box comes back as a new box, with the old name if nothing else took it, and its disk as it was. Restoring renews the copy's 7 days.
• It does not count toward the 20 snapshots you can keep.
• Remove it sooner. Delete now on the row removes the copy at once; zero data retention removes every copy and stops new ones.

A delete removes the machine, its disk, its tunnel and SSH identity, and any phone access password right away. The box's event history, its usage on your ledger, and the audit rows that name it stay in your workspace until the workspace is erased.

Deletion operations

Every delete answers with an operation you can poll instead of watching the box or snapshot.

curl -X DELETE -H "Authorization: Bearer $PRIZED_TOKEN" https://prized.dev/api/v1/boxes/<box-id>
# {"box":{...},"operation":{"id":"dop_…","kind":"box_delete","status":"pending",...}}

curl -H "Authorization: Bearer $PRIZED_TOKEN" https://prized.dev/api/v1/operations/dop_…
# {"operation":{"id":"dop_…","kind":"box_delete","status":"completed","completedAt":"…"}}

status runs pending, processing, completed (for a box, the moment it reads terminated), or failed with error, which is rare and worth a support message. DELETE /api/v1/snapshots/<id> answers the same way with kind: "snapshot_delete"; deleting something already being deleted returns the same operation; finished operations stay readable for 30 days. From the CLI, prized ops status <id> prints one and --wait polls it. Every route is on the API reference.

Zero data retention

Dashboard → Workspace → Data and privacy, owner only, from the dashboard (no CLI token can switch it). Turning it on asks you to type exactly delete deleted box data; turning it off asks nothing. With it on:

• A deleted box leaves no final snapshot, so a delete cannot be undone, and earlier copies are removed at once. Prized's own disaster-recovery backups are separate: this switch does not turn them off, and each ages out within a week (see below).
• The box monitor stores no process or port history, and deletes what it already stored. Metrics are kept 24 hours instead of 30 days.
• Snapshots you take yourself are untouched.
• The audit log keeps every row for its full window (audit rows are workspace metadata, not box data), but the exec, file.upload, file.download, and prompt rows are written with no detail (no detail kept (zero data retention)).

Closing a workspace

Dashboard → Workspace → Close workspace, owner only, confirmed by typing the workspace's name. At once:

• The plan is canceled immediately. Credit in the balance stays but is not refunded; if you reopen, you pick a plan again.
• Every box is paused; disks are kept.
• Every CLI token, install link, and phone access password is revoked. Your own dashboard sign-in stays, so invoices stay readable and you can reopen.
• Other members are removed, the invite link stops working, and domain auto-join is switched off.
• You get one email naming the deletion date.

Nothing is deleted for 30 days. A banner names the date, and Reopen clears the close: boxes stay paused until you start them, the plan is not restored, and auto-join stays off until you switch it back on. Until you reopen, no box can start or wake and no plan can be bought or changed.

Erase now, below Close, skips the window: it terminates every box and disk, deletes every snapshot, secret, environment, and token, the audit log and policies, cancels the plan (any overage owed bills on a final invoice, as for any cancelled plan), removes the billing account from Stripe, and signs you out for good. There is no undo.

Records retained after deletion

Deleting a box or a snapshot removes the machine, the disk, and the storage; the box's event history, its ledger usage, and the audit rows that name it stay in the workspace that owns them.

Erasing the workspace (Erase now, or 30 days after a close) deletes everything in it: boxes, disks, snapshots, secrets, environments, tokens, members, the ledger, hourly usage, event history, audit log, policies, and CLI usage aggregates. What remains:

• Invoices and payment records at Stripe, as required for tax and accounting. Prized keeps no copy of your ledger.
• Sign-in identity history: which provider account (Google or GitHub) signed in as which user, so a reassigned or recreated mailbox cannot inherit a deleted account's standing.
• Fleet-level aggregate telemetry: counts describing the fleet as a whole, with no per-customer identity.
• Disaster-recovery backups of box disks, for up to a week after the disk is gone. Prized keeps a rolling week of encrypted backups of every box disk to recover from a platform failure; they are not visible to you, no customer action removes them early, and each ages out on its own within a week.

Telemetry retention windows