Legal
Data Retention, Export, Switching and Deletion Notice
Last updated: 7 September 2026
1. Scope
This notice summarises the standard lifecycle for Customer Data processed through CyfroSec services. A signed Order Form, customer agreement or Data Processing Addendum prevails if it states different customer-specific terms.
2. Active-service retention
During an active subscription, Customer Data is retained for the period reasonably required to provide the selected services, subject to configured functionality, legal requirements and customer instructions. Temporary repository clones and technical workspaces are removed following successful processing, failure, cancellation, timeout or recovery handling and have a maximum ordinary technical retention period of 30 days.
3. Export
Customers may export available Customer Data during the subscription and applicable retrieval period. Exportable categories are intended to include:
- asset and endpoint inventories;
- scan results, findings and available evidence summaries;
- CyfroAssistant conversations where enabled; and
- CyfroCode findings and remediation drafts.
Available formats may include CSV, JSON, API output and downloadable reports. Supported formats and technical limitations depend on the selected module and Documentation.
Export does not include CyfroSec source code, models, algorithms, internal security rules, platform-security information, third-party confidential information or information concerning other customers.
4. Switching
Where Regulation (EU) 2023/2854, the EU Data Act, applies to the services, a customer may submit a switching request to support@cyfrosec.com identifying the affected services, destination, requested data categories and requested date.
CyfroSec will provide switching assistance required by applicable law, including available data egress, relevant technical information, reasonable continuity within the agreed scope and secure removal of exportable data after completion. The standard switching process is intended to be completed within 30 calendar days from expiry of the applicable notice period unless applicable law permits an extension because completion is technically unfeasible within that period.
CyfroSec does not impose switching charges where prohibited by law. Additional migration, consultancy or implementation services beyond mandatory assistance may be charged only at rates agreed in advance.
5. Paid subscriptions
For 30 calendar days after termination or expiry of a paid subscription, the customer ordinarily retains access to its account and available Customer Data for retrieval. Access may be limited to read-only mode. The customer is responsible for completing export within this period.
After the retrieval period, account access may be suspended. Customer Data associated with the paid subscription is scheduled for permanent deletion from CyfroSec systems 90 calendar days after termination or expiry, subject to legal holds, mandatory retention and backup ageing.
6. Free trials
Data associated with a 14-day free trial is retained for 120 calendar days after trial expiry and then permanently deleted unless the trial converts to a paid subscription. Conversion causes the paid-subscription lifecycle to apply from the subscription start date.
Any permitted use of filtered and de-identified trial information for CyfroSec model improvement is governed by the AI Transparency Notice and does not extend the 120-day source-data retention period.
7. Backups and legal retention
Data removed from active systems may remain in protected backups until overwritten through the ordinary backup-ageing cycle. Backup data is isolated from ordinary use and restored only for continuity, disaster recovery or legal requirements. The maximum ordinary backup-ageing period is 90 days. If a backup is restored, applicable deletion instructions are re-applied where technically feasible.
CyfroSec may retain limited information required for tax, accounting, fraud prevention, security investigations, sanctions compliance, regulatory obligations or legal claims. Such information is access-restricted, used only for the relevant retention purpose and deleted when that purpose ends.
8. Requests
Requests concerning export, switching, return or deletion may be submitted to privacy@cyfrosec.com or support@cyfrosec.com. CyfroSec may verify the requester’s identity and authority and may provide reasonable written confirmation that applicable deletion workflows have been initiated or completed.