🔒 Understanding Data Retention

Learn how Scaut keeps screening data for as long as you need it, then removes sensitive information automatically to protect privacy and support your compliance obligations.

What data retention means

Data retention is how long Scaut keeps the data from a screening after the check reaches a final state. It balances your record-keeping needs against privacy and regulatory requirements. The retention clock starts when a check reaches its final state, not when it was ordered.

Which checks it applies to

Retention applies to checks that have reached a final state:

• Complete: the check finished successfully.
• Failed: the check could not be completed.
• Archived: the check was moved to the archive.
• Expired: the order expired before it was completed.

For how expiry and archiving work in detail, see "Understanding Check Expiration" and "Understanding Check Archiving".

What is kept and what is deleted

When the retention period ends, Scaut keeps only a minimal record and permanently deletes the sensitive data.

Kept as a minimal record:

• First name
• Surname
• The order's reference name

Permanently deleted:

• Date of birth
• Email address
• Phone number
• All documents related to the check
• Supporting documentation
• Verification materials

How long data is kept

Maximum by plan. Your subscription sets the longest retention period you can choose:

Custom period. Each organization can set its own retention period in its settings but it cannot exceed your plan's maximum.

Changing or extending retention

You configure retention in your organization's Governance settings.

To keep data longer than your current plan allows, upgrade:

• Basic to Starter extends the maximum to 90 days.
• Starter to Starter plus extends it to 12 months.
• If you need longer than 12 months, consider an Enterprise solution

Contact sales@scaut.com for upgrade options. Upgrading extends retention for checks you run after the upgrade. It does not retroactively extend retention for checks that already exist.

If you downgrade your plan

• Checks that already exist keep their retention period until it expires.
• New checks follow the lower plan's maximum.
• Export any reports you need before downgrading.

Deletion is permanent

⚠️ Once sensitive data is deleted at the end of the retention period, it cannot be recovered. Before a check's period expires:

• Download any reports you need.
• Export any data you need to keep for the longer term.
• Set retention periods that match how long you actually need the data.

Data subject requests

If a subject asks for their data to be deleted, the request is handled in line with your organization's configured retention policy and the legal obligations that apply to you. Because the right approach depends on your jurisdiction and your role as data controller, confirm how to handle a specific request with your Data Protection Officer or legal adviser.

Timeline example

1. Day 0: the check reaches its final state and the retention clock starts.
2. During the retention period: the full record, including sensitive data, is available.
3. End of the retention period: sensitive data is permanently deleted and only the minimal record (names and the order reference) remains.

A check may also auto-archive before its retention period ends, depending on your configuration. Archiving does not change the retention rules. See "Understanding Check Archiving".

Best practices

• Set the shortest period that meets your needs.
• Write down the reasoning behind your retention policy.
• Review your retention settings on a regular schedule.
• Consider whether different check types or sectors need different periods.

Suggested retention periods

These are starting points only. Periods longer than your plan's maximum require a plan that supports them.

💡 Tip: set a calendar reminder ahead of the retention expiry for any critical check, so you can download reports or export data while the full record is still available. Remember that upgrading your plan extends retention for future checks only, not for checks that already exist.