Purpose
This policy describes how long Himaya keeps the data it processes and how that data is deleted. We keep data only as long as it is needed to protect your workspace, support investigations or meet your requirements.
What we keep
Data is retained according to what it is used for:
- Analysis resultsVerdicts, scores, evidence and message trace records, so you can investigate and audit decisions.
- Quarantined mailAn encrypted copy of quarantined messages, so administrators can release or permanently block them.
- Intercept attachmentsAttachments secured by Himaya Intercept are encrypted and kept for 30 days. Secure links expire after 72 hours by default, configurable up to 10 days, and can be revoked at any time.
- Outbound inspectionExtracted text is never stored. Only digests and lengths of each message part are kept, along with the decision and the rule that made it.
- Audit and evidenceAudit logs of administrative actions, and immutable compliance evidence records kept under retention tiers.
Configurable retention
Retention windows are configurable for your organization, so you can align them with your own policies and regulatory obligations.
Deletion
You can request deletion of your data at any time. At the end of your contract, your data is deleted in full. Disconnecting an integration stops new collection from that source.
Full deletion on request or at contract end.
Trials and proofs of concept
The same security and handling apply during a trial or proof of concept. If you do not continue, you can request deletion of your data at the end of the evaluation.
Data subject requests
We support data subject access and deletion requests and help customers meet their obligations under data protection laws such as GDPR.
Review
This policy is reviewed at least annually and whenever retention for a data category changes.