Your workspace’s data is yours: you can take it with you or delete it at any time. This page sums up the controls in the app; the privacy policy and the security page give the full picture.

Export your data

In Settings › Your data, Export as JSON downloads everything in the workspace: domains and their settings, audits with their scores and changes, findings (accepted or not), suppliers, attestations, prospects, the remediation plan, look-alike takedown cases (evidence, reports, history) and status pages (settings, components, incidents; the number of subscribers, never their addresses). Any member can export.

Delete the workspace

End the paid plan first, if there is one, and wait for the end of the period already paid: a workspace cannot be deleted while a subscription is running (see Plans, payment and invoices).
In Settings › Your data, type the workspace’s identifier (shown in the field) to confirm.
Press Delete workspace.

Only the owner can delete a workspace. Audits and alerts stop at once, and the data is erased for good after 90 days.

To leave a workspace you were invited to, ask its owner to remove you. Removing a single domain deletes its history straight away (see Your list of domains).

How long things are kept

Audits and DMARC reports: the history of your plan (30 days on Free, 12 months on Solo, 24 months on the Agency plans) plus 90 days, so that a change of plan does not erase them at once; the latest audit of each domain is always kept.
Alerts sent: 6 months. Activity of the workspace: 12 months.
Checks of a single finding (“Check if it is fixed”): 30 days.
Free checks from the public site: a summary for 7 days.
DMARC report messages: erased as soon as they are read; what they say follows the history of your plan.

What we never keep

The contents of sensitive files found by the optional file probe: only that they are exposed.
Breached e-mail addresses or passwords: with a Have I Been Pwned key, only the numbers and the breach names.
Your card details: they go straight to our payment processor.

Tokens and keys you give us (DNS providers, ticket trackers, Have I Been Pwned) are stored encrypted, used only for what you connected them for, and deleted when you disconnect them.

Passive by design

Perimetry Cloud reads what anyone on the internet can see: public DNS, certificate logs, the answers of your servers, public databases. It never attacks, never tries to sign in, and never scans a domain in depth before its owner proves it is theirs. See how it works.