> Toden documentation. For the full index fetch /llms.txt. Every page is available as Markdown by appending .md to its URL. Identity verification uses /api/kyc, Risk Intelligence uses /api/v1; they are separate contracts with different error shapes. Never invent an endpoint, field or enum value: read the API reference page for the operation first. # Data retention > Retention periods for uploads, sandbox media, supporting documents, session data, address data and logs, how deletion works and the retention settings available in the console. Toden holds identity data on your behalf: documents, selfies, results and the records built from them. This page states how long each kind of data is kept, which periods you can set yourself, and how to remove a record. It is written for compliance and data protection leads, and for developers who need to know when a media URL stops returning the original file. > **Note** > > This page describes how the product behaves. Your contract and data processing agreement with Toden set out the legal terms. How long **you** must keep verification records depends on the rules that apply to your business. ## Summary | Data | Kept for | Who sets it | | ----------------------------------------------------- | ---------------------------------------------------------------- | ----------------- | | Completed verifications and their results | Until you delete them | You | | Captured media on a completed production verification | As long as the verification | You | | Uploads never attached to a verification | 30 minutes, longer for some documents in a resumable session | Fixed | | Media on sandbox test verifications | 3 days, then replaced by a placeholder | Fixed | | Supporting document files | As long as the verification, or a period you choose per workflow | You, per workflow | | Saved progress of an unfinished session | Until the session expires | You, per workflow | | Uploaded names and addresses in a bulk address upload | 180 days, then removed | Fixed | | Daily address presence observations | 365 days after the check resolves | Fixed | | API request logs | 7 days | Fixed | | Audit log entries | No automatic expiry | Fixed | ## Uploads before submission Files are uploaded while a person moves through a verification, before anything is submitted. An upload that is never attached to a verification is deleted automatically. | Upload type | Lifetime if never submitted | | ------------------------------------------------------- | ------------------------------------------------------------- | | Selfie, liveness recording, document capture recordings | 30 minutes, always | | ID document images, supporting documents | 30 minutes. In a resumable session, up to 24 hours | | Company documents and proof of address | 30 minutes. In a resumable session, until the session expires | The rule behind the table: the more sensitive the data and the easier it is to capture again, the shorter it is held. A selfie takes seconds to retake, so biometric captures are never held longer. A certificate of incorporation can take days to find, so it lives as long as the application it belongs to. While a person is actively working through a session, the lifetime of the uploads their saved progress refers to is renewed under the same per-type limits. Once they stop, the clock runs out. ## Session data A verification session that is not finished keeps the person's progress so that they can resume. By default a session lasts 24 hours for an individual and 7 days for a business application. You can set a session lifetime between 1 and 720 hours per workflow, in the workflow's advanced session settings. When a session expires, or you expire it early, its saved progress is erased. The session record itself remains, so your list still shows that an attempt was started and where it stopped. ## Sandbox media Media captured on a Sandbox test verification is kept for **3 days**. After that the files are deleted and the verification's media URLs return a placeholder image instead of an error, so your integration tests keep working without Toden holding test captures indefinitely. The verification record and its result stay. The same 3-day rule applies to photos used in sandbox face match checks. ## Supporting documents Supporting documents are extra files a workflow collects, such as an identity slip, that you may only need checked and not held. By default the files are kept as long as the verification. To shorten that: ### Open the workflow Go to **Configuration → Workflows**, open the workflow and select its supporting documents step. ### Turn on deletion Enable the option to delete collected documents after a set period. ### Choose the period Pick how long to keep the files: 7, 30, 60 or 90 days, 6 months, or 1, 2, 5 or 10 years. Through the workflow configuration the value is `supportingDocuments.retentionDays`, any whole number of days from 1 to 3650. ### Publish Publish the workflow. The period applies to verifications submitted after that. When the period ends, the files are deleted. The check results stay on the verification, so nothing you branch on or report is lost, and the document's media URL returns a placeholder. If a verification is sent back and the documents are carried forward, the original deletion date is kept: a resubmission does not restart the clock. ## Address data | Data | Retention | | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Bulk address upload | 180 days after upload, the uploaded names and addresses are removed. The grade given to each row, its locality and your own customer reference are kept, so reports and run comparisons still work | | Address presence check | Only per-day summaries are ever stored, never a location trail. They are deleted 365 days after the check resolves. The outcome and its totals are kept as the lasting record. A check that is still running is never pruned | The console states both periods where they apply: beside the list of address upload runs, and on a resolved presence check whose daily evidence has been removed. ## Logs * **API request logs**, under **Developers → Logs**, are kept for 7 days. They hold request summaries and timings. * **Audit log entries** have no automatic expiry and cannot be edited or deleted. See [Audit logs](/get-started/console/audit-logs). ## Verifications held for insufficient credit If a production verification cannot be charged because your balance is too low, Toden may hold it, with the person's captures, so that it can run once you add credit. The hold is short, three days as standard. When it ends without payment the verification fails and the captures are deleted. The console shows held work and its deadline in **Organisation → Billing**. ## Deleting records You can delete a verification, an unfinished attempt, a spot check, a face match check or a customer record from the console or the API. Each has its own permission: `verifications:delete`, `spot_checks:delete`, `business_checks:delete` and `identity:delete`. Deletion is **soft**: * The record disappears from every list, detail page, export, analytics figure and API response in your organisation. * Toden keeps it, marked as deleted, so that a compliance history cannot be rewritten without trace. * A verification that is still processing cannot be deleted until it finishes. * Deleting does not refund the verification. * Deleting a customer record pauses its ongoing screening. A deleted record cannot be restored from the console or the API. If something was deleted by mistake, contact Toden support, who can restore it. See [Manage records](/user-verification/server-api/manage-records) for the API. Two removals are permanent because the data would otherwise keep working against the person: | Action | Effect | | ----------------------------------------- | ----------------------------------------------------------------------------- | | Revoking a customer's biometric enrolment | Their stored face templates are deleted, so the face can no longer be matched | | Removing an entry from a face list | The entry and its photo are deleted | ## Data minimisation in what you receive Retention covers what Toden stores. Separately, each workflow step has a **Returned data** setting that limits which fields and media links are sent to you in webhooks. Use it when you want a result without receiving, and therefore having to retain, the underlying personal data. See [Workflows](/user-verification/workflows/workflows). ## Related * [Manage records](/user-verification/server-api/manage-records) * [Audit logs](/get-started/console/audit-logs) * [Sandbox testing](/get-started/sandbox-testing) * [Environments](/get-started/environments)