Skip to main content

sigmashake-docs — Data retention policy

What the documentation site retains, and for how long.

The rule of thumb is minimize and time-bound. The docs site is a static site. It has no accounts, no sessions, no database, and no audit log of its own. It stores no customer data. For SigmaShake services that do hold customer data, the Privacy Policy (Section 7) and the Data Processing Agreement (Section 10) set the retention periods.

Retention rules​

content_retention​

  • Storage. Public documentation source in the git repository, and the static files that Cloudflare Pages serves.
  • TTL. No time limit. The content is public.
  • Deletion process. A commit removes a page, and the next deploy removes the served file.

delivery_logs​

  • Storage. Edge request logs and aggregate traffic metrics kept by Cloudflare.
  • TTL. Set by Cloudflare. SigmaShake does not control these logs.

font_requests​

  • Storage. Every page loads a stylesheet from fonts.googleapis.com. Google receives the reader's IP address, user agent and referrer. Google is a sub-processor; its DPA and transfer assessment are pending.
  • TTL. Set by Google. SigmaShake does not control these logs.

Customer-initiated deletion (DSAR right-to-be-forgotten)​

SigmaShake holds no personal data about docs-site readers. Cloudflare (delivery) and Google (fonts) receive reader IP addresses and other request metadata as sub-processors. See dsar-runbook.md for the steps to route a request to the right service.

Backup retention​

The docs site has no database to back up. The git repository holds the content.

For the platform services, the Business Continuity Plan describes the backup arrangement that is documented today: a weekly d1-backup-export snapshot of the compliance database to the sigmashake-d1-backups R2 bucket, with a 90-day Object Lock rule, and a daily d1-backup-verify check. This page states no backup cadence for other data stores, because no cadence is documented for them.

Audit​

The ISMS owner reviews this policy by hand. No evidence collector checks this page. SigmaShake has no SOC 2 report.