Exports and retention
Export authorized data and keep it only as long as the real purpose requires.
Export the intended scope
Filter the workspace, project, form, dates, and workflow state before creating an export. Confirm the requester has access to every included record.
Protect exported files
Treat CSV and archive files as copies of private submissions. Store them securely, limit sharing, and delete temporary exports after use.
Enforce the retention decision
Choose a period that matches the stated purpose. Deletion should hide message content immediately and schedule dependent file removal while preserving required tombstones.
Documentation reviewed on October 20, 2026Suggest an improvement →