# Data retention

> What pausing, deleting, and closing keep and remove, how zero data retention changes that, and what Prized retains afterwards.

URL: https://prized.dev/docs/data-retention

## Pause vs delete [#pause-vs-delete]

| Action          | Machine                            | Disk         | Files, tools, git state | Undo                                                                                |
| --------------- | ---------------------------------- | ------------ | ----------------------- | ----------------------------------------------------------------------------------- |
| Pause           | Stopped, billed at the paused rate | Kept         | Kept                    | Resume any time                                                                     |
| Delete          | Terminated                         | Erased       | Gone from the box       | Restore the final snapshot within 7 days (none for a box deleted in its first hour) |
| Close workspace | Every box paused                   | Kept 30 days | Kept 30 days            | Reopen within 30 days                                                               |
| Erase workspace | Terminated                         | Erased now   | Gone                    | None                                                                                |

Deep sleep is a pause with the disk moved to a snapshot; deleting a box in deep sleep erases that snapshot and leaves no undo copy. Disks and snapshots are encrypted at rest ([Security and trust](https://prized.dev/docs/security#data-at-rest-and-in-flight)).

## Deleting a box [#deleting-a-box]

A deleted box's last state is kept 7 days as a snapshot named `deleted-<box>-<date>`, under **Recently deleted** on the **Deleted** tab of **Dashboard → Boxes**.

* **None for a box deleted within an hour of being created**: its contents came from its image, snapshot, or source box.
* **Undo a delete** by restoring the snapshot: a new box with the disk as it was, under the old name if nothing else took it. Restoring renews the copy's 7 days.
* **It does not count** toward the 20 snapshots you can keep.
* **Remove it sooner.** **Delete now** on the row removes the copy at once; [zero data retention](#zero-data-retention) removes every copy and stops new ones.

A delete removes the machine, its disk, its tunnel and SSH identity, any phone access password, and its [command history](https://prized.dev/docs/exec#command-history) right away; what stays is under [Records retained after deletion](#records-retained-after-deletion).

## Deletion operations [#deletion-operations]

Every delete returns an operation you can poll.

```bash
curl -X DELETE -H "Authorization: Bearer $PRIZED_API_KEY" https://prized.dev/api/v1/boxes/<box-id>
# {"box":{...},"operation":{"id":"dop_…","kind":"box_delete","status":"pending",...}}

curl -H "Authorization: Bearer $PRIZED_API_KEY" https://prized.dev/api/v1/operations/dop_…
# {"operation":{"id":"dop_…","kind":"box_delete","status":"completed","completedAt":"…"}}
```

`status` is `pending`, `processing`, `completed` (for a box, once it reads `terminated`), or `failed` with `error` (rare, and worth a support message). `DELETE /api/v1/snapshots/<id>` answers the same way with `kind: "snapshot_delete"`. Deleting something already being deleted returns the same operation, and finished operations stay readable for 30 days.

From the CLI, `prized ops status <id>` prints one and `--wait` polls it. Every route is on the [API reference](https://prized.dev/docs/api).

## Zero data retention [#zero-data-retention]

**Dashboard → Settings → Data and privacy**, owner only (no API key can switch it), on [custom plans](https://prized.dev/docs/billing#custom-plans). On a self-serve rung or the free credit, **Talk to us** (a short form we answer by email) replaces the switch, and the API answers `403 plan_required`. Turning it on asks you to type exactly `delete deleted box data`; turning it off asks nothing and works on any plan.

With it on:

* A deleted box leaves no final snapshot, so a delete cannot be undone; earlier copies are removed at once. Prized's disaster-recovery backups are not affected and each ages out within a week (see [below](#records-retained-after-deletion)).
* Metrics are kept 24 hours instead of 30 days, and the Metrics page stores no process or port history (what it stored is deleted).
* Snapshots you take yourself are untouched.
* The [audit log](https://prized.dev/docs/teams#audit-log) keeps every row for its full window, but `exec`, `file.upload`, `file.download`, and `prompt` rows are written with no detail (`no detail kept (zero data retention)`).
* [Command history](https://prized.dev/docs/exec#command-history) keeps that a command ran, who ran it, when, how it ended, and how many bytes it printed, but no command line, directory, or output; turning it on deletes those from existing records.

## Closing a workspace [#closing-a-workspace]

**Dashboard → Settings → Data and privacy → Close workspace**, owner only, confirmed by typing the workspace's name. At once:

* The plan is canceled. Credit in the balance stays but is not refunded.
* Every box is paused; disks are kept.
* Every API key, install link, and phone access password is revoked. Your own dashboard sign-in stays, so invoices stay readable and you can reopen.
* Other members are removed, the invite link stops working, and domain auto-join is switched off.
* You get one email naming the deletion date.

Nothing is deleted for 30 days; a banner names the date. **Reopen** clears the close: boxes stay paused until you start them, you pick a plan again, and auto-join stays off until you switch it back on. Until you reopen, no box can start or wake and no plan can be bought or changed.

**Erase now**, below Close, skips the window: it terminates every box and disk; deletes every snapshot, secret, environment, and token, the audit log, and policies; cancels the plan (any overage owed bills on a final invoice, as for any [cancelled plan](https://prized.dev/docs/billing#overage)); removes the billing account from Stripe; and signs you out for good. There is no undo.

## Records retained after deletion [#records-retained-after-deletion]

Deleting a box or a snapshot removes the machine, the disk, and the storage; the box's event history, its ledger usage, and the [audit rows](https://prized.dev/docs/teams#audit-log) that name it stay in the workspace until the workspace is erased.

Erasing the workspace (**Erase now**, or 30 days after a close) deletes everything in it: boxes, disks, snapshots, secrets, environments, tokens, members, the ledger, hourly usage, event history, command history, audit log, policies, and CLI usage aggregates. What remains:

* **Invoices and payment records at Stripe**, as required for tax and accounting. Prized keeps no copy of your ledger.
* **Sign-in identity history**: which provider account (Google or GitHub) signed in as which user, so a reassigned or recreated mailbox cannot inherit a deleted account's standing.
* **Fleet-level aggregate telemetry**: counts describing the fleet as a whole, with no per-customer identity.
* **Disaster-recovery backups of box disks**, for up to a week after the disk is gone: a rolling week of encrypted backups of every box disk, kept to recover from a platform failure. You cannot see them, and no customer action removes them early.

## Telemetry retention windows [#telemetry-retention-windows]

| Data                                                                                                   | Kept                                               | With zero data retention                                    |
| ------------------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- |
| Box metrics (CPU, memory, disk, network)                                                               | 30 days                                            | 24 hours                                                    |
| Process and listening-port snapshots (pinning a moment on the Metrics page)                            | 72 hours                                           | Not stored                                                  |
| CLI usage aggregates (command names, versions, exit codes)                                             | 90 days                                            | 90 days                                                     |
| Sign-in records (time, network address, browser)                                                       | 90 days                                            | 90 days                                                     |
| Audit log ([Teams](https://prized.dev/docs/teams#retention))                                                             | 90 days by default, 7 to 365 by policy             | Same; the detail of exec, file, and prompt rows is not kept |
| Command history (what `prized exec` and the edge ran, with up to the last 1 MiB of each output stream) | 30 days, or until you delete the record or the box | 30 days; no command line, directory, or output              |