Data retention | Toden Docs

Toden holds identity data on your behalf: documents, selfies, results and the records built from them. This page states how long each kind of data is kept, which periods you can set yourself, and how to remove a record. It is written for compliance and data protection leads, and for developers who need to know when a media URL stops returning the original file.

This page describes how the product behaves. Your contract and data processing agreement with Toden set out the legal terms. How long you must keep verification records depends on the rules that apply to your business.

Summary

Data	Kept for	Who sets it
Completed verifications and their results	Until you delete them	You
Captured media on a completed production verification	As long as the verification	You
Uploads never attached to a verification	30 minutes, longer for some documents in a resumable session	Fixed
Media on sandbox test verifications	3 days, then replaced by a placeholder	Fixed
Supporting document files	As long as the verification, or a period you choose per workflow	You, per workflow
Saved progress of an unfinished session	Until the session expires	You, per workflow
Uploaded names and addresses in a bulk address upload	180 days, then removed	Fixed
Daily address presence observations	365 days after the check resolves	Fixed
API request logs	7 days	Fixed
Audit log entries	No automatic expiry	Fixed

Uploads before submission

Files are uploaded while a person moves through a verification, before anything is submitted. An upload that is never attached to a verification is deleted automatically.

Upload type	Lifetime if never submitted
Selfie, liveness recording, document capture recordings	30 minutes, always
ID document images, supporting documents	30 minutes. In a resumable session, up to 24 hours
Company documents and proof of address	30 minutes. In a resumable session, until the session expires

The rule behind the table: the more sensitive the data and the easier it is to capture again, the shorter it is held. A selfie takes seconds to retake, so biometric captures are never held longer. A certificate of incorporation can take days to find, so it lives as long as the application it belongs to.

While a person is actively working through a session, the lifetime of the uploads their saved progress refers to is renewed under the same per-type limits. Once they stop, the clock runs out.

Session data

A verification session that is not finished keeps the person’s progress so that they can resume. By default a session lasts 24 hours for an individual and 7 days for a business application. You can set a session lifetime between 1 and 720 hours per workflow, in the workflow’s advanced session settings.

When a session expires, or you expire it early, its saved progress is erased. The session record itself remains, so your list still shows that an attempt was started and where it stopped.

Sandbox media

Media captured on a Sandbox test verification is kept for 3 days. After that the files are deleted and the verification’s media URLs return a placeholder image instead of an error, so your integration tests keep working without Toden holding test captures indefinitely. The verification record and its result stay. The same 3-day rule applies to photos used in sandbox face match checks.

Supporting documents

Supporting documents are extra files a workflow collects, such as an identity slip, that you may only need checked and not held. By default the files are kept as long as the verification. To shorten that:

Open the workflow

Go to Configuration → Workflows, open the workflow and select its supporting documents step.

Turn on deletion

Enable the option to delete collected documents after a set period.

Choose the period

Pick how long to keep the files: 7, 30, 60 or 90 days, 6 months, or 1, 2, 5 or 10 years. Through the workflow configuration the value is supportingDocuments.retentionDays, any whole number of days from 1 to 3650.

Publish

Publish the workflow. The period applies to verifications submitted after that.

When the period ends, the files are deleted. The check results stay on the verification, so nothing you branch on or report is lost, and the document’s media URL returns a placeholder. If a verification is sent back and the documents are carried forward, the original deletion date is kept: a resubmission does not restart the clock.

Address data

Data	Retention
Bulk address upload	180 days after upload, the uploaded names and addresses are removed. The grade given to each row, its locality and your own customer reference are kept, so reports and run comparisons still work
Address presence check	Only per-day summaries are ever stored, never a location trail. They are deleted 365 days after the check resolves. The outcome and its totals are kept as the lasting record. A check that is still running is never pruned

The console states both periods where they apply: beside the list of address upload runs, and on a resolved presence check whose daily evidence has been removed.

Logs

API request logs, under Developers → Logs, are kept for 7 days. They hold request summaries and timings.
Audit log entries have no automatic expiry and cannot be edited or deleted. See Audit logs.

Verifications held for insufficient credit

If a production verification cannot be charged because your balance is too low, Toden may hold it, with the person’s captures, so that it can run once you add credit. The hold is short, three days as standard. When it ends without payment the verification fails and the captures are deleted. The console shows held work and its deadline in Organisation → Billing.

Deleting records

You can delete a verification, an unfinished attempt, a spot check, a face match check or a customer record from the console or the API. Each has its own permission: verifications:delete, spot_checks:delete, business_checks:delete and identity:delete.

Deletion is soft:

The record disappears from every list, detail page, export, analytics figure and API response in your organisation.
Toden keeps it, marked as deleted, so that a compliance history cannot be rewritten without trace.
A verification that is still processing cannot be deleted until it finishes.
Deleting does not refund the verification.
Deleting a customer record pauses its ongoing screening.

A deleted record cannot be restored from the console or the API. If something was deleted by mistake, contact Toden support, who can restore it. See Manage records for the API.

Two removals are permanent because the data would otherwise keep working against the person:

Action	Effect
Revoking a customer’s biometric enrolment	Their stored face templates are deleted, so the face can no longer be matched
Removing an entry from a face list	The entry and its photo are deleted

Data minimisation in what you receive

Retention covers what Toden stores. Separately, each workflow step has a Returned data setting that limits which fields and media links are sent to you in webhooks. Use it when you want a result without receiving, and therefore having to retain, the underlying personal data. See Workflows.