Data Retention Policy

1. Retention Principles

CipherVPN's data retention framework is governed by three principles derived from GDPR Article 5(1)(e), the UK Data Protection Act 2018, and industry best practices:

• Minimal collection — we don't retain what we don't need to collect in the first place
• Purpose limitation — data collected for one purpose is not retained for another
• Automated deletion — wherever possible, retention is enforced by automated processes rather than manual procedures
• Accountability — retention decisions are documented in this schedule and reviewed annually

This policy applies to all data held in CipherVPN production systems, backup archives, disaster recovery systems, and data held by sub-processors acting on our behalf.

Key: Auto-deleted = enforced programmatically   Legal hold = retention required by statute   Manual review = reviewed case-by-case

2. Full Retention Schedule

3. VPN-Specific Data Retention

In addition to the general schedule, the following VPN-specific retention rules apply:

What is NEVER Retained

• Your real (pre-tunnel) IP address after session establishment
• DNS queries made through the VPN tunnel
• Destination IP addresses or hostnames of any connections made within the tunnel
• URLs, web page content, or any payload data
• Per-destination traffic volume or timing
• Packet metadata that could be used to correlate tunnel sessions with outbound connections

What is Temporarily Retained (≤7 days)

Connection timestamps (session start and end, UTC) and server node used are retained for a maximum of 7 days as a rolling window for:

• Detecting and responding to Terms of Service violations (e.g., account credential sharing)
• Managing concurrent device limits per subscription plan
• Network capacity planning and server load balancing

Automatic deletion of session timestamps is enforced by a scheduled job running every 24 hours that purges records older than 7 days. This is auditable by inspection of the infrastructure configuration.

4. CipherMail Data Retention

End-to-End Encrypted Messages

Messages encrypted using CipherVPN's E2E encryption protocol or PGP are stored as opaque encrypted ciphertext. CipherVPN holds no decryption keys. These messages are retained until:

• You manually delete them
• Your account auto-expiry policy (set in Mail Settings) deletes them
• Your account is deleted (all messages purged within 30 days)

Outbound SMTP (Relay to External Providers)

When you send email to external addresses (non-CipherVPN recipients), the message passes through SMTP relays for delivery. SMTP relay logs (sender, recipient, timestamp, delivery status) are retained for 14 days for delivery diagnostics, then automatically deleted. Message body content is never logged.

Mail Metadata

For internal CipherVPN-to-CipherVPN messages, routing metadata (sender, recipient, timestamp) is retained within your encrypted mailbox. It is encrypted at-rest and subject to the same deletion rules as message content.

Spam & Abuse Hashes

To prevent spam, we store one-way cryptographic hashes of flagged message fingerprints for 90 days. These hashes cannot be reversed to reveal message content.

5. Billing & Financial Data Retention

Financial records are subject to mandatory statutory retention under tax and company law. These records are retained regardless of account deletion requests.

Payment card numbers are never stored by CipherVPN. The payment processor (Stripe) maintains tokenised payment methods in accordance with PCI-DSS. Upon account deletion, payment tokens are revoked from the payment processor within 30 days.

6. Legal Hold Procedures

When CipherVPN receives a valid legal order requiring preservation or disclosure of data, a legal hold is activated:

1. Order review — legal counsel reviews the order for validity, scope, and jurisdiction
2. Scope limitation — the hold is scoped to the minimum data described in the order
3. Preservation flag — affected records are flagged to prevent automated deletion during the hold period
4. Notification — where legally permitted (i.e., no gag order attached), the affected user is notified
5. Hold release — when the legal matter concludes, the hold is released and data follows normal retention rules

7. Deletion Procedures

Standard Deletion

When data reaches the end of its retention period or an account deletion request is processed:

• Database records — hard-deleted (not soft-deleted) from production databases within 30 days
• Object storage — files overwritten with random data then deleted within 30 days
• Encrypted fields — key material for field-level encryption is rotated and old keys destroyed, rendering existing ciphertext permanently unreadable even if media is never overwritten

Backup Deletion

Data deleted from production systems persists in encrypted backups until the backup rotation cycle completes (maximum 90 days). After 90 days, all production-deleted data has been purged from the backup chain.

Media Sanitisation

When physical media (SSDs, HDDs) is decommissioned, we follow NIST SP 800-88 Rev. 1 media sanitisation guidelines:

• SSDs: cryptographic erasure (destroy encryption key) + secure erase command
• HDDs: 3-pass overwrite per DoD 5220.22-M standard
• Failed drives: physical destruction, certificate of destruction retained

8. Backup Retention

All backup archives are stored in geographically separate locations from production systems, with access restricted to a maximum of 3 named operations personnel. Backup restoration procedures are tested quarterly.

9. Enterprise Retention Configuration

Enterprise customers can configure custom retention policies for their organisation's data through the Admin Dashboard → Data Governance panel:

• Custom VPN log retention — extend session timestamp retention up to 90 days for internal compliance auditing (retain only within your private infrastructure; CipherVPN does not receive this data)
• Mail archiving — configure automated email archiving to your organisation's own S3-compatible storage
• Audit log export — schedule automated export of administrator audit logs to your SIEM
• Account lifecycle policies — auto-suspend or delete inactive accounts after configurable periods

Enterprise retention configurations do not override CipherVPN's minimum or maximum retention obligations under this policy or applicable law. Contact enterprise@ciphervpn.eu for configuration assistance.

10. Exercising Your Deletion Rights

Under GDPR Article 17 and equivalent laws, you have the right to erasure of your personal data. To request deletion:

1. Self-service: Account Settings → Privacy → Delete My Account — this triggers automated deletion of all personal data within 30 days
2. Manual request: Email privacy@ciphervpn.eu with your account email and "Erasure Request" in the subject line

We will confirm deletion within 30 days. Note that legally-required data (billing records under 7-year rule) will be retained in isolated, restricted storage — we will inform you which categories cannot be deleted and the legal basis.

You may also request a Data Portability export (GDPR Art. 20) before deleting your account. Exports are provided in JSON format within 30 days of request to privacy@ciphervpn.eu.