Data Retention Schedule

Principles

Information is retained only for as long as it is needed to provide the service, to meet the organization's own record-keeping obligations, and to satisfy legal, regulatory and contractual requirements.

Indicative periods

• Active account and member records — for the duration of the subscription.
• Financial records (contributions, loans, repayments, expenses) — for the duration of the subscription and thereafter as required by the organization's applicable record-keeping obligations.
• KYC documents — for the period required by the organization's applicable obligations, then deleted.
• Audit logs — retained to preserve accountability, and restricted to authorized roles.
• Operational and security logs — retained for a limited period appropriate to investigation and troubleshooting.
• Backups — retained on a rolling cycle and overwritten in the ordinary course.

After termination

Following termination, data may remain available for a defined window to allow authorized export or recovery, after which it is deleted subject to applicable retention requirements. Customers can request deletion earlier, subject to those requirements.