Trust · Data retention

Data retention

How long ProcureTrace keeps what you upload, and how deletion works. ProcureTrace is not a system of record — keep your original documents.

Where your data lives

Documents, extracted values, results, decisions, and account data are stored with Microsoft Azure in the Canada Central region. Automated document reading transmits document content to Azure document-analysis and AI services operated in United States regions, under ProcureTrace's subscription, solely to extract the values the review compares. Your documents are not used to train models — ours or any provider's. Account emails (verification, password reset) are delivered through our email provider, Resend.

While your account is active

Uploaded documents, extracted values, review results, reviewer decisions, and reports are kept for the life of the review they belong to. Account information (email address, hashed credential, role, status) is kept for the life of the account.

Deleting a review

Deleting a review removes its documents, extracted data, runs, and findings from the application immediately, leaving an id-only deletion record with no content.

Inactive accounts

An account with no successful sign-in for 14 consecutive days is deleted automatically, together with the reviews and documents it owns. Signing in resets that period. In a shared workspace, only the inactive account is removed; workspace data is deleted only with its last remaining member.

Backups

Deleted data may remain temporarily in our providers' backup and recovery systems — currently up to 7 days of database point-in-time backups and 7 days of storage soft-delete retention — until those periods expire. It is not immediately erased from every backup.

Deletion requests and legal holds

Deletion inside the application takes effect immediately. For anything else, write to admin@procuretrace.com. We may retain specific data longer only where the law requires it, and only for that purpose.