Data Retention Policy

This Data Retention Policy (the "Policy") outlines the principles and practices by which Credenti ("Credenti," "we," "our," or "us") collects, retains, and disposes of personal and organizational data. The Policy is designed to ensure compliance with applicable legal and regulatory obligations, contractual commitments, and industry best practices.

Definitions

  • Data: Any information, in digital or physical form, that is collected, stored, processed, or transmitted by Credenti systems.
  • Employee: Any individual employed by Credenti, including contractors, temporary staff, and other persons performing work under Credenti’s direction.
  • Data Protection Officer (DPO): The individual designated by Credenti to oversee data protection strategy, compliance, and regulatory liaison in accordance with applicable laws.
  • GDPR: The General Data Protection Regulation (EU) 2016/679, a comprehensive privacy law governing data protection and privacy in the European Union.
  • Data Subject: An identified or identifiable natural person whose personal data is processed by Credenti or on its behalf.
  • Personal Data: Any information relating to an identified or identifiable natural person, including names, identification numbers, location data, online identifiers, or other attributes.
  • Processing: Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, dissemination, or destruction.
  • Processor: A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
  • Special Categories of Personal Data / Sensitive Personal Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, data concerning health, or data concerning a natural person's sex life or sexual orientation.
  • SIEM (Security Information and Event Management): A technology platform or solution that provides real-time analysis of security alerts and logs generated by applications, network hardware, and systems. SIEM tools are commonly used to collect, normalize, store, and analyze data for security monitoring and regulatory compliance purposes.

1. Purpose

This Data Retention Policy ("Policy") provides guidance regarding the proper storage and timely destruction of all information, data, and documents, regardless of format, generated in connection with the Company’s business.

The owner of this document is the Data Protection Officer of Credenti.

These guidelines are reviewed annually by the Data Protection Officer and may also be reviewed and updated continuously, if deemed necessary by the Data Protection Officer.

The purpose of this Policy is to define the retention periods and procedures for data processed by Credenti in connection with its products and services. Retention is limited to the duration necessary to fulfill contractual, legal, and operational requirements.

2. Scope

This Policy applies to all data collected, processed, or stored by Credenti, including but not limited to:

  • System authentication logs and access events
  • User identity and device metadata
  • Access policies and configuration files
  • Administrative activity records

3. Retention Periods

Unless otherwise expressly stipulated in a binding agreement, Credenti retains data in accordance with the following categorized schedules. These schedules are established to ensure compliance with relevant legal and regulatory obligations while accounting for operational efficiency and system performance limitations. In particular, due to the high volume and transient nature of certain log types, such as user activity and administrative logs, these categories are maintained for shorter durations. Customers are strongly advised to implement timely export and archival procedures by leveraging external Security Information and Event Management (SIEM) solutions or comparable systems to facilitate long-term retention, analysis, and compliance.

This policy applies across all Credenti deployment models, including multi-tenant cloud, dedicated private cloud, and on-premises environments.

  • User Activity Logs: Includes records of user sessions, application usage, and login/logout events. Retained for a period not exceeding 90 days. Offloading to external SIEM or log retention systems is strongly encouraged.
  • Administrative Logs: Encompasses actions performed within administrative consoles, such as user provisioning, policy updates, and configuration changes. Retained for 90 days. Customers should implement log forwarding to external systems for extended access.
  • Authentication and Access Logs: Pertains to credential-based access activity, including badge tap events, biometric authentications, and passkey usage. Retained for 90 days from the date of collection.
  • User Metadata: Refers to identity records such as user profile data, device associations, and enrollment statuses. Retained for the duration of the customer account or until account termination.
  • Configuration and Policy Data: Comprises settings, templates, access rules, and session policies. Retained for the duration of the customer account or until account termination.

Modifications to the standard retention windows may be accommodated upon request, provided such changes are supported by applicable legal or regulatory requirements and aligned with platform capabilities. Requests must be documented and authorized through a formal data processing or service agreement.

4. Employee Data Retention

Credenti retains employee-related data only to the extent required for business operations, regulatory obligations, or internal governance. Retention and processing of such data are subject to applicable employment laws and data protection regulations.

  • Administrative Activity Logs: Retained for 24 months
  • Credentialed Access Records: Retained for 12 months from the date of last use
  • Employment Metadata: Removed within 90 days following termination of employment unless legal obligations require otherwise

All employee data is governed by the same controls applied to customer data, including encryption, access restrictions, and audit procedures.

5. Data Minimization and Deletion Procedures

Credenti implements the principle of data minimization by retaining only the data necessary for the stated purposes. In accordance with applicable law, including but not limited to the GDPR, Personal Data shall not be retained for longer than is necessary for the purposes for which it was collected. Once such purposes have been fulfilled, Personal Data shall be securely erased, unless a longer retention period is required or permitted by law.

The data deletion and destruction methods utilized by Credenti are based on the secure erasure capabilities provided by Amazon Web Services (AWS), our infrastructure provider. These include but are not limited to AWS-managed encryption key deletion (crypto-shredding), storage lifecycle policies, and secure overwrite or decommissioning procedures. All methods are designed to be consistent with recognized industry standards and regulatory obligations.

Credenti ensures that the erasure of Personal Data through AWS mechanisms adheres to one of the following recognized legal methods:

  • Anonymization: This involves the permanent removal or transformation of all elements of Personal Data that could identify a natural person. Proper anonymization ensures that the data cannot, by any means, be traced back to an individual—even by the party responsible for the anonymization. Notably, encrypted or tokenized data does not qualify as anonymized if there exists a means to reverse the process.
  • Destruction: This refers to the complete and irreversible elimination of Personal Data such that it cannot be reconstructed or retrieved. When applicable, destruction may be achieved through cryptographic erasure (also known as crypto-shredding), which involves deleting the encryption keys used to secure the data, rendering it permanently inaccessible. These deletion processes are executed using AWS-supported mechanisms designed to meet applicable legal and technical standards. The level of technical rigor applied depends on the classification and sensitivity of the data in question.

The specific methods by which Personal Data is deleted or destroyed in Credenti’s systems are implemented using the underlying capabilities made available by Amazon Web Services (AWS). Credenti’s Data Protection Officer (DPO) defines the internal standards and governance policies that apply these AWS-supported mechanisms in a manner that meets relevant regulatory obligations, security benchmarks, and contractual commitments.

Where Personal Data is processed or stored using a third-party service provider (e.g., Software-as-a-Service or Business Process Outsourcing platforms), Credenti shall verify and document the method by which erasure is performed. In such cases, the requirement for secure deletion of Personal Data shall be explicitly included in contractual agreements with the service provider, ensuring that either Credenti or its designated processor executes erasure in a lawful and effective manner.

6. Regulatory and Legal Compliance

This Policy is intended to ensure compliance with applicable data protection and information security laws, including but not limited to:

  • General Data Protection Regulation (GDPR)
  • California Consumer Privacy Act (CCPA)
  • Health Insurance Portability and Accountability Act (HIPAA)
  • Federal Risk and Authorization Management Program (FedRAMP)
  • Criminal Justice Information Services (CJIS) Security Policy
  • Payment Card Industry Data Security Standard (PCI DSS)

7. Policy Review and Amendments

This Policy is reviewed on at least an annual basis or as required by changes to laws, regulations, or operational requirements. Any material changes to this Policy will be communicated to affected parties via official channels or posted publicly on our Trust Portal.

Contact Information

Questions about this Policy should be directed to privacy@credenti.com or by writing to us at 5177 Richmond Ave, STE 1160, Houston, TX 77056. Please note that email communications may not be secure. Accordingly, you should not include personal or other sensitive information in your email correspondence to us.