Retention
| Data | Kept for | Enforced by |
|---|---|---|
| Email content (subject, body, links, attachments) | Not stored. Processed in memory for the duration of one request. | Scan route holds no persistence path for message content |
| Verdict cache | 24 hours, then expires. Keyed by a hash of the masked content; sender display names removed before writing. | KV time-to-live, redaction before write |
| Scan audit trail (org, sender domain, score, classification) | 90 days | Weekly retention job deletes older rows |
| Verdict feedback (score, signal types, sender domain) | 90 days | Weekly retention job |
| Organization keys, trusted senders, vendor registry | Until you remove them or the organization is offboarded | Removed on request within 5 business days |
| Vendor account numbers | Never stored. Only a keyed one-way hash and the last four characters. | Hashed on entry; the number is discarded |
| Uptime probe samples | 90 days | Weekly retention job |
| Self-diagnosis reports (aggregate rule precision) | 1 year | No content, domains, or identifiers |
Backup and recovery
Organization data (keys, trusted senders, vendor registry, audit trail) lives in a managed PostgreSQL database with daily automated backups retained for 7 days. Restores are tested by exporting every organization table and verifying the export is complete; each drill and its result are recorded in the repository under docs/security. Email content is never in the database, so a restore never restores mail.
Recovery objective: organization data restored within 4 business hours of a confirmed loss, to the most recent daily backup. Verdicts continue during a database outage in rules-only mode; trusted-sender and vendor-registry checks resume when the database returns.
Incidents
Availability is probed every 10 minutes through the real scan path and published at /phishguard/status. A state change alerts the operator immediately.
A security incident affecting your organization's data is reported to the contact email on file within 24 hours of confirmation, with what was affected, what was done, and what you should do. A compromised client release is withdrawn by revoking its published checksum and issuing a replacement; the status page carries the notice.
To report a vulnerability or an incident, use the contact form at /contact and choose "Security or vulnerability report". We acknowledge within one business day.
Offboarding
On request, an organization's keys are revoked immediately and its trusted senders, vendor registry, and audit rows are deleted within 5 business days. Nothing else about the organization is held.
Sub-processors: Vercel (hosting, United States), Supabase (database, United States), Anthropic (AI second opinion, United States, only when enabled and only masked text), Google Gemini (United States, operator console only: image analysis and report generation submitted by staff, never end-user scans). Full data-flow description: /phishguard/privacy.