Data Retention & Deletion Policy
Anteriq (“we,” “us,” or “our”) is committed to handling data responsibly. This policy describes how long Anteriq retains data it processes in connection with the Service and how that data is deleted or de-identified when retention is no longer needed.
1. Purpose & Scope
This policy governs the retention and deletion of data that Anteriq processes to provide its practice management and client operations platform for financial planning firms (the “Service”). It applies to:
- Customer Data — data submitted by or on behalf of Customer firms, including question responses, uploaded documents, and end-client account information; and
- Service-generated operational data — audit logs, session records, activity events, and other records created automatically by the Service.
This policy applies to data stored in Anteriq’s AWS infrastructure (DynamoDB, S3, KMS-encrypted storage) and to data held by Anteriq’s Subprocessors as identified in the Subprocessor List.
This policy is incorporated by reference into the Anteriq Terms of Service at §10.5. The Data Processing Addendum does not incorporate or name this policy; it states its own return and destruction terms directly at §11, covering the same 30-day post-termination export window and subsequent deletion. In the event of conflict between this policy and those agreements, the terms of the agreements govern.
2. Data Categories & Retention Periods
| # | Category | Examples | Retention Period |
|---|---|---|---|
| 1 | Active customer & end-client data | Question answers, uploaded documents, end-client account records, firm configuration | Retained for the duration of the customer firm’s active subscription or engagement. Deletion occurs after the post-termination Export Window described in Section 3. |
| 2 | Activity / engagement events | Module-open events, library-link-open events, and to-do task completion and reopen events | Time-limited via automated DynamoDB TTL expiration. 548 days. |
| 2a | Security, audit, billing, and platform events | Login events, security incident records, full audit trail events, billing/invoice records, platform-level administrative events | Retained indefinitely (no TTL). Firm-scoped security, audit, and billing events are removed when a firm-wide deletion is performed. Platform-level administrative events — Anteriq’s own record of firm creation, export, and deletion — are retained as Anteriq business records and survive firm-wide deletion. These records are not subject to the 548-day activity TTL. |
| 2b | Anteriq subscription billing records (Plan invoices and deleted-firm plan summaries) | Monthly Plan invoices, refund records, deleted-firm plan summaries (tombstones) | Retained indefinitely as Anteriq’s own business and tax records; survive firm-wide deletion. The record retains invoice line items, amounts, status/refund history, and the billing state/postal-code snapshot. A reusable saved payment method is not retained — the Stripe Customer and vaulted card are deleted at firm deletion; paid invoices keep a masked card summary (brand + last 4 digits) as part of the permanent transaction record. |
| 2c | Legal acceptance records (firm administrators) | Record of which version of the Terms of Service or Privacy Policy a firm administrator accepted, when, and from what IP address | Retained indefinitely as Anteriq’s own business records; survive firm-wide deletion. Retained under the dispute-resolution exception in Section 5 — these are the records by which Anteriq’s agreement with a Customer is established and enforced, and the obligations they evidence (fees, limitations of liability, dispute resolution) outlast the subscription. End-client acceptance records are not covered by this category: they fall under Category 1 and are deleted with the rest of the firm’s data. |
| 3 | Short-lived operational records — impersonation tokens & consent | Super-admin impersonation session tokens (15-minute TTL + 24-hour cleanup); per-firm impersonation consent records (7-day TTL + 24-hour cleanup) | Impersonation tokens: TTL 15 minutes, purged within 24 hours. Consent records: TTL 7 days, purged within 24 hours. These records exist only for the duration of an active support session and are not retained thereafter. |
| 3a | Short-lived operational records — dedup markers | Module-open deduplication markers; Stripe event-deduplication markers | Module-open dedup markers: 2 days. Stripe event-dedup markers: 90 days. Automated DynamoDB TTL expiration. |
| 4 | Short-lived operational records — file-upload staging | Temporary pre-signed upload references and staging metadata | Automated TTL expiration of 1 hour after upload initiation. Staged objects that are not committed are subject to S3 lifecycle rules. |
| 5 | Authentication & session records | Cognito session tokens, client and admin JWT refresh windows | Governed by the Cognito app-client token TTLs: client sessions 60-minute access / 60-day refresh; administrator sessions 15-minute access / 8-hour refresh. Tokens expire and are not stored by Anteriq’s application layer beyond their natural Cognito lifetime. |
| 6 | Backups | Point-in-Time Recovery (PITR); scheduled immutable backups of the database and of file storage | Database PITR is enabled with a 35-day continuous recovery window. In addition, scheduled backups of the database and of file storage are written to a backup vault under AWS Backup Vault Lock: daily copies retained 35 days, and one monthly copy retained 12 months. For a seven-day cooling-off period after the vault is created, the lock operates in governance mode — it is in force, but Anteriq can still change or remove the lock configuration, which is the only window in which a wrong retention value can be caught. Once that period ends the lock configuration is permanent: a backup copy cannot be altered, and cannot be deleted before its retention period expires — including by Anteriq. That immutability is the control that protects backups against accidental or malicious destruction. File storage separately retains prior versions of changed or deleted objects for 90 days. Retained copies remain subject to this policy’s confidentiality and security obligations, and are used only to restore the Service. |
| 7 | Operational / infrastructure logs | AWS CloudWatch logs, Lambda execution logs, API Gateway access logs, AWS CloudTrail records | 365 days. An explicit 365-day (1-year) retention policy is applied to the Anteriq application’s production Lambda and API Gateway log groups in AWS CloudWatch. AWS CloudTrail logs are delivered to a dedicated S3 bucket and retained for approximately 400 days via an S3 lifecycle policy. |
| 8 | Aggregated / de-identified usage data | Platform-level analytics derived from Customer Data with no reasonable means of re-identification | May be retained beyond the periods above in accordance with §4.6 of the Terms of Service. No Personal Information is retained in this form. |
Note on categories 3–5: The short automated expiration of these records reflects their operational nature. They are not retained for business intelligence or marketing purposes.
3. Post-Termination: Data Export & Deletion
3.1 Export Window
Upon termination or expiration of a Customer’s subscription or Order (as defined in the Terms of Service), Anteriq will make Customer Data available for export by the Customer for a period of 30 days (the “Export Window”). During the Export Window, Customer may request an export of its Customer Data in a commercially reasonable format.
3.2 Deletion After Export Window
After the Export Window closes, Anteriq will delete or de-identify Customer Data in Anteriq’s possession or control as described in Section 4, subject to the exceptions in Section 5. End-client account records, question data, uploaded documents, and associated operational records will be removed from active storage. The mechanisms by which export and deletion are carried out are described in Section 6.
3.3 Customer-Initiated Deletion
Customers may request early deletion of Customer Data prior to the expiration of the Export Window by contacting Anteriq at privacy@anteriq.com. Anteriq will process confirmed deletion requests in accordance with this policy and applicable law. See Section 5 for legal-hold exceptions.
4. Deletion Method
4.1 Logical and Physical Deletion
Anteriq’s deletion process consists of two stages:
- Logical deletion: The record is marked deleted and is no longer accessible through the Service. This occurs upon the triggering event (e.g., end of Export Window, TTL expiration).
- Physical deletion / de-identification: The record is removed from the database, or — for stored files — the object is deleted from storage.
For DynamoDB, TTL-based expiration results in eventual physical removal by AWS within a period after the TTL timestamp passes (per AWS documentation, typically within 48 hours, but not guaranteed). During that window, TTL-expired items are not returned by standard read operations and are inaccessible through the Service.
4.2 Encryption at Rest and Cryptographic Erasure
All Customer Data is encrypted at rest. Beneath the application, AWS encrypts every store under keys Anteriq does not manage — object storage (Amazon S3) uses SSE-S3, which is AES-256 encryption with Amazon S3-managed keys, and the database (Amazon DynamoDB) uses its default AWS-owned key; neither of those keys is held in Anteriq’s own KMS key inventory or governed by a key policy Anteriq controls. Above that, Anteriq’s application code adds a second layer to sensitive data fields, to documents uploaded by end clients, and to signed documents, using a single dedicated application KMS CMK (customer master key) in AWS Key Management Service (KMS). The application CMK encrypts each class of sensitive data under a distinct encryption context that binds the ciphertext to the specific record it belongs to, so a ciphertext cannot be silently moved to a different record and each key access is individually attributable. Automatic annual key rotation is enabled on this CMK; key material is rotated yearly while the key ID and all existing ciphertext remain valid.
Because this key is shared across the Service, it is not disabled or destroyed as part of an individual firm’s deletion, and cryptographic erasure of a single firm’s data is not a control Anteriq relies on. A firm’s encrypted records are removed by physical deletion of the underlying database items and storage objects, as described in Section 4.1. Physical deletion removes those records from active storage. Copies contained in backups taken before the deletion persist until those backups expire on the schedule in Section 2 (Category 6); see Section 5.
4.3 Subprocessor Retention and Deletion
Anteriq has not separately negotiated or executed a data processing agreement with any Subprocessor. It relies instead on each vendor’s standard published terms, which Anteriq accepts on engaging the service. For two of those vendors, data-processing commitments are incorporated into those terms by reference rather than by signature: Amazon Web Services’ Data Processing Addendum is incorporated into the AWS Service Terms and applies without a separate signature, and Stripe’s Data Processing Agreement forms part of the Stripe Services Agreement. Anteriq makes no equivalent representation for its e-signature and transactional-email vendors. Anteriq holds no deletion commitment from any Subprocessor beyond what that Subprocessor’s standard terms provide.
Those standard terms, and not this policy, govern how long each Subprocessor retains the data Anteriq sends it. A Subprocessor’s own retention period may be longer than the corresponding period in Section 2.
The customer-directed integrations identified in the Subprocessor List are not engaged by Anteriq. The customer firm holds its own account and agreement with each of those vendors, and data held there is retained and deleted under that agreement.
See the Subprocessor List for the current list of Subprocessors and their data-handling obligations.
5. Legal Holds & Exceptions
Anteriq may retain Customer Data beyond the periods described above, notwithstanding a termination or deletion request, where:
- Legal obligation: Applicable law, regulation, or a lawful government order requires retention for a specified period. This includes records Anteriq must keep as a business — tax and accounting records, records of its own billing and payment transactions, and records of security incidents and any resulting notifications.
- Litigation hold: Anteriq reasonably anticipates, or is subject to, litigation, arbitration, regulatory inquiry, or law enforcement process that makes the data relevant. Anteriq will notify Customer that a hold has been placed on its data to the extent permitted by law, and maintains internal procedures for placing, tracking, and releasing holds.
- Dispute resolution: Retention of records necessary to resolve a billing dispute or enforce the Terms of Service. Anteriq’s own subscription billing records are retained indefinitely as business records and are not subject to firm-wide deletion. Other record classes are retained for the period during which such a dispute could reasonably arise, and no longer.
- Backup cycles: As described in Section 2 (Category 6), copies may persist in routine backup media after deletion, until those copies expire in the ordinary course. The maximum such period is 12 months, set by the longest backup retention tier; most copies expire within 35 days. Because a backup copy cannot be selectively edited, an individual record cannot be removed from a backup that already exists — it is removed when the backup containing it expires. Retained backup copies remain subject to this policy’s confidentiality and security obligations, are not used for any purpose other than restoring the Service, and are not accessible through the Service.
Customer’s own obligations. A Customer firm may itself be subject to recordkeeping requirements — for example, the books-and-records rules that apply to registered investment advisers. Anteriq’s deletion of data from the Service does not satisfy or discharge those obligations, and a firm subject to them should export and retain what it needs before requesting deletion.
Where a legal-hold exception applies, Anteriq will retain only the data necessary to satisfy the obligation and will delete it when that obligation is resolved.
6. Export and Deletion Capabilities
| Capability | How it is performed |
|---|---|
| Per-client export — all data associated with a single end-client, including answers, documents, and activity | Available to firm administrators directly in the Service, at any time |
| Firm-wide export — a complete export of all Customer Data for a firm | Performed by Anteriq on the firm’s request. Because it egresses an entire firm’s records, it requires a platform administrator to re-authenticate immediately beforehand |
| Firm-wide deletion — removal of all active Customer Data for a firm | Performed by Anteriq on request or at the close of the Export Window, under the same re-authentication requirement |
Deletion of a firm’s data is carried out as an immediate removal rather than a deferred one: records are deleted outright rather than being flagged for later expiry.
A small number of records survive a firm-wide deletion:
- Anteriq’s own subscription billing records and deleted-firm plan summaries, as described in Section 2, Category 2b;
- Anteriq’s platform-level administrative log of firm creation, export, and deletion, as described in Section 2, Category 2a;
- Anteriq’s record of which version of its Terms of Service and Privacy Policy each firm administrator accepted, as described in Section 2, Category 2c. End-client acceptance records are deleted;
- a non-reversible fingerprint of the payment card used at signup, retained to prevent repeat abuse of free trials. This is a value supplied by our payment processor that cannot be used to reconstruct a card number or charge a card;
- a record that a promotional code was redeemed; and
- the routine backup copies described in Section 5, until they expire in the ordinary course — at most 12 months after the backup was taken.
Customers may contact Anteriq at privacy@anteriq.com to request an export or deletion.
7. Changes to This Policy
Anteriq may update this policy from time to time. Anteriq will provide at least 30 days’ advance notice of material changes, by email to Customer’s account owner at the email address on file for the account, or through the Service; non-material changes, such as clarifications and contact updates, take effect upon posting. This matches the notice period used in the Terms of Service and the DPA.
The current version of this policy is published at /legal/retention.