Security & Data Retention

Last updated 2026-10-27

A plain-language summary of how we protect data and how long we keep it. It complements the Privacy Notice and the DPA.

Security measures

• encryption of data in transit (HTTPS/TLS); • per-tenant isolation of customer data enforced at the database level (row-level security); • role-based access controls and least-privilege access for staff; • hardened cloud infrastructure and restricted database credentials; • monitoring and logging for security and troubleshooting. • two-factor authentication, revocable per-device sessions with a device list, and an e-mail alert on a sign-in from a device we do not recognise; • rate limiting and account lock-out on repeated failed sign-ins; • encrypted, off-site backups that cannot be altered or deleted for a fixed period, kept with a different provider from the one running the service; • no measure makes any system immune: we describe what we do, review it regularly, and notify affected customers without undue delay if something happens.

Backups and recovery

Customer data is backed up on a regular schedule to allow recovery from failure. The backup frequency, retention window and recovery objectives applicable to your plan are set out in your subscription; we do not rely on a blanket "no liability for data loss" position.

Retention periods

• Enquiry / access-request data — kept while we follow up and for a reasonable period afterwards, then deleted. • Customer account and content — kept for the subscription term; on termination, deleted or returned per the DPA. • Accounting and tax records — kept for the statutory periods required by applicable law (US federal and state tax rules), then deleted or anonymised. • Server/security logs — kept for a limited period for security and troubleshooting.

Export and deletion

Customers can export their data during the subscription and request deletion or return on termination. For requests, contact support@nucra.io.