# Data retention

> What pausing, deleting, and closing keep and remove; the undo window for deleted boxes; zero data retention; and what is retained afterwards.

URL: https://prized.dev/docs/data-retention

## Pause vs delete [#pause-vs-delete]

| Action          | Machine                            | Disk         | Files, tools, git state | Undo                                     |
| --------------- | ---------------------------------- | ------------ | ----------------------- | ---------------------------------------- |
| Pause           | Stopped, billed at the paused rate | Kept         | Kept                    | Resume any time                          |
| Delete          | Terminated                         | Erased       | Gone from the box       | Restore the final snapshot within 7 days |
| Close workspace | Every box paused                   | Kept 30 days | Kept 30 days            | Reopen within 30 days                    |
| Erase workspace | Terminated                         | Erased now   | Gone                    | None                                     |

Deep sleep is a pause that moves the disk to a snapshot; nothing here changes it, except that deleting a box while it is in deep sleep erases that snapshot and leaves no undo copy — there is no disk attached to take a final snapshot of. Disks and snapshots are encrypted at rest ([Security and trust](https://prized.dev/docs/security#data-at-rest-and-in-flight)).

## Deleting a box [#deleting-a-box]

Deleting a box terminates the machine and erases its disk. Its last state is kept for 7 days as a snapshot named `deleted-<box>-<date>` under **Recently deleted** on **Dashboard → Snapshots**.

* **Undo a delete.** Restore the snapshot: the box comes back as a new box, with the old name if nothing else took it, and its disk as it was. Restoring renews the copy's 7 days.
* **It does not count** toward the 20 snapshots you can keep.
* **Remove it sooner.** **Delete now** on the row removes the copy at once; [zero data retention](#zero-data-retention) removes every copy and stops new ones.

A delete removes the machine, its disk, its tunnel and SSH identity, and any phone access password right away. The box's event history, its usage on your ledger, and the [audit rows](https://prized.dev/docs/teams#audit-log) that name it stay in your workspace until the workspace is erased.

## Deletion operations [#deletion-operations]

Every delete answers with an operation you can poll instead of watching the box or snapshot.

```bash
curl -X DELETE -H "Authorization: Bearer $PRIZED_TOKEN" https://prized.dev/api/v1/boxes/<box-id>
# {"box":{...},"operation":{"id":"dop_…","kind":"box_delete","status":"pending",...}}

curl -H "Authorization: Bearer $PRIZED_TOKEN" https://prized.dev/api/v1/operations/dop_…
# {"operation":{"id":"dop_…","kind":"box_delete","status":"completed","completedAt":"…"}}
```

`status` runs `pending`, `processing`, `completed` (for a box, the moment it reads `terminated`), or `failed` with `error`, which is rare and worth a support message. `DELETE /api/v1/snapshots/<id>` answers the same way with `kind: "snapshot_delete"`; deleting something already being deleted returns the same operation; finished operations stay readable for 30 days. From the CLI, `prized ops status <id>` prints one and `--wait` polls it. Every route is on the [API reference](https://prized.dev/docs/api).

## Zero data retention [#zero-data-retention]

**Dashboard → Workspace → Data and privacy**, owner only, from the dashboard (no CLI token can switch it). Turning it on asks you to type exactly `delete deleted box data`; turning it off asks nothing. With it on:

* A deleted box leaves no final snapshot, so a delete cannot be undone, and earlier copies are removed at once. Prized's own disaster-recovery backups are separate: this switch does not turn them off, and each ages out within a week (see [below](#records-retained-after-deletion)).
* The box monitor stores no process or port history, and deletes what it already stored. Metrics are kept 24 hours instead of 30 days.
* Snapshots you take yourself are untouched.
* The [audit log](https://prized.dev/docs/teams#audit-log) keeps every row for its full window (audit rows are workspace metadata, not box data), but the `exec`, `file.upload`, `file.download`, and `prompt` rows are written with no detail (`no detail kept (zero data retention)`).

## Closing a workspace [#closing-a-workspace]

**Dashboard → Workspace → Close workspace**, owner only, confirmed by typing the workspace's name. At once:

* The plan is canceled immediately. Credit in the balance stays but is not refunded; if you reopen, you pick a plan again.
* Every box is paused; disks are kept.
* Every CLI token, install link, and phone access password is revoked. Your own dashboard sign-in stays, so invoices stay readable and you can reopen.
* Other members are removed, the invite link stops working, and domain auto-join is switched off.
* You get one email naming the deletion date.

Nothing is deleted for 30 days. A banner names the date, and **Reopen** clears the close: boxes stay paused until you start them, the plan is not restored, and auto-join stays off until you switch it back on. Until you reopen, no box can start or wake and no plan can be bought or changed.

**Erase now**, below Close, skips the window: it terminates every box and disk, deletes every snapshot, secret, environment, and token, the audit log and policies, cancels the plan (any overage owed bills on a final invoice, as for any [cancelled plan](https://prized.dev/docs/billing#overage)), removes the billing account from Stripe, and signs you out for good. There is no undo.

## Records retained after deletion [#records-retained-after-deletion]

Deleting a box or a snapshot removes the machine, the disk, and the storage; the box's event history, its ledger usage, and the audit rows that name it stay in the workspace that owns them.

Erasing the workspace (**Erase now**, or 30 days after a close) deletes everything in it: boxes, disks, snapshots, secrets, environments, tokens, members, the ledger, hourly usage, event history, audit log, policies, and CLI usage aggregates. What remains:

* **Invoices and payment records at Stripe**, as required for tax and accounting. Prized keeps no copy of your ledger.
* **Sign-in identity history**: which provider account (Google or GitHub) signed in as which user, so a reassigned or recreated mailbox cannot inherit a deleted account's standing.
* **Fleet-level aggregate telemetry**: counts describing the fleet as a whole, with no per-customer identity.
* **Disaster-recovery backups of box disks**, for up to a week after the disk is gone. Prized keeps a rolling week of encrypted backups of every box disk to recover from a platform failure; they are not visible to you, no customer action removes them early, and each ages out on its own within a week.

## Telemetry retention windows [#telemetry-retention-windows]

| Data                                                          | Kept                                   | With zero data retention                                    |
| ------------------------------------------------------------- | -------------------------------------- | ----------------------------------------------------------- |
| Box metrics (CPU, memory, disk, network)                      | 30 days                                | 24 hours                                                    |
| Process and listening-port snapshots (the monitor's scrubber) | 72 hours                               | Not stored                                                  |
| CLI usage aggregates (command names, versions, exit codes)    | 90 days                                | 90 days                                                     |
| Sign-in records (time, network address, browser)              | 90 days                                | 90 days                                                     |
| Audit log ([Teams](https://prized.dev/docs/teams#retention))                    | 90 days by default, 7 to 365 by policy | Same; the detail of exec, file, and prompt rows is not kept |