Book a Demo
Book a Demo Sign in
Data Retention & Deletion Policy

Data Retention & Deletion Policy

Version 0.1 (provisional) · Last updated: October 23, 2026

This policy explains how long Helios Cloud Suite LLC ("Helios," "we") keeps Customer Data, what happens to it when a Subscription ends, and how it is deleted. It forms part of the Agreement. Where this policy describes how the Service works "today," it states a fact about the Service as it currently runs, not a promise that it will stay that way. The Data Processing Addendum and the Business Associate Agreement set out Helios's deletion obligations; this policy describes how they are carried out.

1. While the Subscription is active

Helios keeps Customer Data for as long as the Subscription is active, so the Service can work. The Customer and its Authorized Users decide what to keep and what to delete inside the Service.

Deleted files and earlier versions. When an Authorized User deletes a file, it goes to a trash bin, and earlier versions of files are kept. Both follow the workspace software's default retention setting: a deleted file can normally be restored for up to 30 days, and deleted files and earlier versions may be removed sooner when the Authorized User's storage space is needed.

2. When a Customer removes an Authorized User

Today, when a Customer's administrator suspends an Authorized User, the Service places that person on a 60-day hold. The hold disables the person's account, keeps their data and frees their Seat straight away. The administrator is emailed when the hold starts and again 7 days before it ends, and can restore the person at any time before then. When the 60 days are up, the person's account, files and mailboxes are deleted automatically.

An administrator can also choose to delete a person straight away instead of placing them on a hold.

3. After cancellation

3.1 Suspension. When a Subscription is cancelled, Helios suspends the Customer's workspace and keeps its data until Helios staff purge it. This also happens when a Subscription ends because payments failed. Ending a Subscription does not, by itself, delete any Customer Data.

3.2 What suspension does today. The Customer's administrator can no longer sign in to the admin portal, and the Customer can no longer add Authorized Users or change its mail domain. Authorized Users' workspace sign-in is not switched off by the suspension. Any 60-day holds the administrator started earlier still end, and are purged, on their own dates. During the retention period after a Subscription ends, Helios will give Authorized Users read-only access to the workspace so that they can export Customer Data (see section 7).

3.3 How long data is kept. Helios will keep Customer Data for 30 days after the Subscription ends, and then purge it (see section 3.4 for how the purge is carried out today).

3.4 When the purge happens. Today the purge is a manual staff action with no schedule. Helios will run the purge automatically at the end of the 30-day retention period.

4. The purge

The purge is the staff action that deletes a suspended Customer's workspace. Today it only runs if the Customer's workspace is suspended, a member of staff types the Customer's workspace name back to confirm it, and the person who approved it is named. The approval is recorded before anything is deleted. The purge then:

  • deletes every Authorized User still on a 60-day hold;
  • deletes each remaining Authorized User's workspace account, which deletes that person's files;
  • deletes each Authorized User's mailboxes, where the Service can prove the mailbox was created for that Customer (any it cannot prove are left in place and recorded for staff to review);
  • deletes the Customer's two workspace groups (its users group and its administrators group);
  • deletes the administrator's account in the sign-in system, where that account is tagged with the Customer's ID; and
  • marks the Customer's record as deleted.

If the Customer has its own dedicated workspace server instead of a shared one, the purge removes that whole workspace server instead of deleting users one by one.

Earlier and deleted versions in storage. Helios will enable object versioning or lifecycle rules on the storage that holds workspace files, so that earlier and deleted versions of files, including files in shared team folders, are kept for up to 30 days and then removed automatically.

5. What the purge does not delete today

The purge does not delete the following today. Helios will extend the purge, or keep the data only for the period stated, as set out for each item.

  • Intranet accounts. Authorized Users' intranet accounts and the Customer's intranet group are not removed. Helios will add them to the purge, so that it removes the Customer's intranet accounts and intranet group.
  • Other sign-in accounts. Only the administrator's account in the sign-in system is deleted. Helios will extend the purge so that it deletes every sign-in account the Customer's Authorized Users have in the sign-in system, not only the administrator's.
  • Custom mail domain. The Customer's custom mail domain and its email signing (DKIM) key stay set up on the mail server. Helios will add them to the purge, so that it removes the Customer's custom mail domain and its DKIM key from the mail server.
  • The Customer's record and history. The Customer's record is marked deleted, not erased. The analytics tables keep the record's history, including the company name, the account owner's email address, the Stripe customer ID and the Authorized Users' mailbox addresses. These tables are stored with Backblaze. Helios will keep this history for 7 years for billing and dispute purposes, and then delete it.
  • Support tickets. See section 9.
  • Audit log. See section 10.
  • Billing records. The purge does not contact Stripe. See section 11.
  • Backup copies. See section 6.

6. Backups and copies stored with Backblaze

6.1 What is copied. Workspace files are stored with Backblaze as the Service's primary file storage (see the Subprocessors List). In addition, the workspace database and the intranet database are backed up every night to a separate storage bucket at Backblaze. The workspace database backup contains user accounts, groups, shares, calendars, contacts, mail-app settings and file metadata.

6.2 How long backups are kept. Helios will keep backup copies for 30 days and then delete them. No backup retention period is configured today; until Helios configures it, backup copies of the database remain in Backblaze storage and a Customer's data in them outlives the purge.

6.3 Copies on the Helios server. Local copies of the intranet database backup are kept on the Helios server for 7 days. Helios will delete copies that staff make by hand (for example, a manual backup of the mail server) when the Customer whose data they contain is purged.

6.4 What is not backed up. Mail, the sign-in system's database, and the support and audit database are not backed up off the Helios server. Data deleted from them is not kept in any off-site backup.

7. Exporting data before deletion

Helios will let the Customer's administrator export Customer Data through self-service until the purge: files from the workspace, and mail over IMAP. Until then, Authorized Users can download their own files from the workspace and copy their own mail over IMAP while their workspace sign-in still works (see section 3.2), and the account owner can ask Helios support for help exporting the Customer's data.

8. Asking for deletion

A Customer can ask Helios to delete its Customer Data before the retention period in section 3.3 ends. Early deletion may be requested only by the account owner, by email to support@helioscloudsuite.com from the account owner's email address; Helios verifies the request before acting on it.

Helios will complete a deletion request within 30 days. Once backup retention is configured (section 6.2), backup copies will be overwritten within 30 days; until then, the Customer's data in the database backups remains in Backblaze storage after the deletion.

9. Support tickets and the AI support assistant

9.1 At Helios. Support tickets are stored in a database on the Helios server. Today there is no process to delete them, and the purge does not delete them. Helios will delete a Customer's support tickets when the Customer's data is purged.

9.2 At Anthropic. When the AI support assistant is turned on for a Customer, ticket text is sent to Anthropic (see the Subprocessors List). Anthropic keeps API inputs and outputs for the period stated in its commercial terms.

10. Logs and the audit log

10.1 Application and server logs. The Service writes logs on the Helios server. Some log entries contain personal data, such as email addresses. Helios will keep application and server logs for 90 days and then delete them.

10.2 Staff audit log. Staff actions are recorded in an append-only audit log, which the application cannot change or delete. The purge does not delete it. Helios will keep the staff audit log, including entries about a purged Customer, for 6 years. The audit log is held in the support and audit database, which is not backed up off the Helios server today (section 6.4).

11. Billing records

Billing records (the Stripe customer record, subscriptions and invoices) are kept by Stripe and are not deleted by the purge. Helios will keep billing records for 7 years after the Subscription ends, and then delete them.

Helios may keep Customer Data for longer than this policy says where the law requires it. Any data kept for that reason stays protected under the Data Processing Addendum and, for PHI, the Business Associate Agreement.