Data retention

Your uploaded file

Deleted within 25 hours of the audit finishing

A copy of every row of your file

Kept with the audit results, original text included, and deleted with them

Free check

Deleted within 25 hours of the audit finishing

Paid report

Kept 3 days after payment, so you can download it

Report opened with a 3-Month Pass

Kept until the pass ends, and at least 3 days after it was opened

Payment records

Kept with no fixed end date: the payment reference, amount, currency, plan and date. The email in a record is erased 120 days after payment

Your email, if you paid

Erased 120 days after payment

IP addresses in our records

Erased after 30 days

Backups

The newest 5 database copies, one taken before each update, and the hosting provider's weekly copies of the whole server (up to about two weeks)

Server logs

Never file contents. Web server log deleted within 15 days, application log within 8

The settlement file you upload is encrypted on arrival and destroyed within 25 hours of the audit completing. It becomes due for deletion 24 hours after the audit completes, and the deletion job, which runs every 15 minutes, destroys it on its next run. The short window exists so a parsing problem can be investigated against the original if something goes wrong in the first day, and for no other reason.

If the audit fails, the file is destroyed on the same schedule. A file that could not be read is no less sensitive than one that could.

The audit itself is a structured set of rows: the reconciliation, the findings, and a copy of every row of your file, each with its original text (up to 600 characters of it). Two columns are never copied: Customer First Name and Customer Last Name, which some Shopify Payments exports carry, are dropped as the file is read. Those copies are where the evidence in your report comes from. They outlive the uploaded file because the audit is what you came for, and deleting the file does not delete them: they are part of the audit, kept with it and deleted with it.

A free check, including its copy of your rows, is deleted within 25 hours of the audit finishing: it becomes due 24 hours after the audit finishes, and the deletion job removes it on its next run. A paid report, rows included, is kept for 3 days after payment so you can download the PDF or CSV, and is then deleted. The report shows the exact date and time.

A payment is never lost to a deletion. Payment closes 30 minutes before a free check is deleted, and if a payment for a check is still going through when the check is due, the check is kept until the payment is confirmed. If our payment provider cannot be reached, a free check can be kept longer, until it can be. A payment that still arrives after its check was deleted is recorded, and we refund it by hand.

After an audit is deleted, our audit log keeps a small record of it with no time limit (the file’s size, its SHA-256 fingerprint, and how many findings and transactions it had, never the contents), and we use anonymous counts of uploads and audits for our own statistics.

Every audit page has a delete control: the free check, the paid report, and a report opened with a pass. Using it removes the encrypted file, the reconciliation, the findings, and the copy of every row of your file immediately. It asks you to confirm first, because it cannot be undone. On a paid report, download your PDF or CSV, or print it, before you delete. A copy already in a backup is removed later, as explained under Backups below.

Before each update to the software, a copy of the database is taken so that a failed update can be undone. The newest 5 copies are kept and the update deletes older ones. The copies stay on the same server, readable only by its administrator account.

A copy holds the audits that existed when it was taken. An audit you delete, or one that reaches the end of its window, can therefore remain in a backup until 5 more updates have happened. Your uploaded file is not in these copies: it is stored apart from the database, encrypted.

Our hosting provider also takes a backup of the whole server every week and keeps the latest few (currently two), stored away from the server. Each one is a copy of everything on the server at that moment: audit results, the copy of every row of your file, and any uploaded file not yet deleted, together with the key that decrypts it. So an audit that is deleted, by you or on schedule, can still exist in one of these backups for up to about two weeks. We cannot delete anything from them; old ones are replaced automatically.

When a file is uploaded or an audit is deleted, the record of it keeps the IP address the request came from, so abuse can be investigated. The address is erased after 30 days; the record that it happened stays, without it. Rate limits count requests per address in counters that are deleted after a day.

The access log of the web server records the address and time of every request and is deleted within 15 days. The log of the application itself records identifiers and counts, never an address and never file contents, and is deleted within 8 days.

A pass is kept for as long as it runs and afterwards as a record of the purchase, the same as any other order. Against it are your email address and the payment reference from your receipt, and those two exist for one reason: a pass is reached by a code, PayoutCheck sends no email, and somebody who loses their code has no other way back to what they paid for. The email is erased 120 days after payment, a month after the pass ends; the payment reference stays, so your receipt can still find the pass.

The code itself is not kept. Only a one-way hash of it is stored, so nobody here can read your code back out - recovering a lost pass means issuing a new code and retiring the old one.

Reports you opened with a pass are kept until the pass ends, and never less than 3 days after each one opened, so one opened on the last day still has time to be downloaded. Each report shows its exact deletion date and time. A refund of the pass does not change those dates.

Card details, which go to our payment provider and never reach us. And the contents of your file in any log: logs record identifiers, sizes and counts, because a log file is read by more people and kept longer than a database.