Data retention and deletion
Questions or requests: security@actaseal.com.
The ledger is hash-chained and tamper-evident. That is in tension with ordinary deletion, so this page states exactly what can be erased and what cannot.
What can be erased
Personal data in the sealed dispute-context section of a record is encrypted with a key that belongs to one data subject. An erasure request destroys that subject's key. The encrypted bytes stay where they are, so the chain still verifies, but the data inside them cannot be recovered. The request and the key's destruction are themselves written to the ledger. This covers:
- the customer's purchase IP address
- device fingerprint and device id
- email address
- shipping address
- customer account id
A legal hold overrides erasure while it is active: the request is refused, and the refusal is recorded.
What cannot be erased
- Customer, order and payment identifiers you send with an action. They are stored as sent, in the action, the ledger and the receipt. If they would be personal data under your law, send pseudonymous ids rather than raw personal identifiers.
- Approver identity. It is recorded permanently in every approval, so that approvals stay attributable. This is deliberate, and it is in tension with erasure rights.
- Free-text reasons entered by an approver. They are permanent. Do not type personal data into them.
- Console user email and display name. There is no erasure mechanism for these.
Retention
The ledger is append-only. A retention lock in the application refuses to clear it before a set date. That lock does not stop someone with direct access to the underlying files or database; for that, use storage-level object lock in your own infrastructure.
The default retention period is 7 years. A 5-year profile and custom periods are available, and your agreement can set a different one.
In a self-hosted deployment your ledger, receipts and evidence stay with you when the agreement ends. ActaSeal holds no copy to return or destroy.
Where your data runs
A self-hosted deployment runs in your environment. Optional third-party services receive nothing unless you switch them on. The services this website and company use are listed on the sub-processors page.