Data Retention & Incident Response

Retention Scope

ClearSplit retains case data, audit logs, and account information according to the following schedule:

Active Cases

Purchased cases remain fully active for 36 months from the date of purchase. During this period, all case data, documents, and features are available without restriction. Data is available for export at any time through the built-in PDF, CSV, and JSON export tools.

Archived Cases

After the 36-month active period, cases transition to lifetime read-only archive status. All data and documents remain accessible for viewing and export, but editing and new uploads are disabled. Archived cases are retained indefinitely at no additional cost.

After Account Deletion

Upon account deletion request, case data and documents are retained for 90 days to allow recovery or final export. After 90 days, case data is permanently and irreversibly deleted from our systems. Encrypted document storage keys are destroyed, rendering uploaded documents unrecoverable.

Audit Logs

Audit trail records (who changed what, when, and the before/after values) are retained for 7 years from creation, independent of case or account status. This extended retention supports compliance requirements, dispute resolution, and legal discovery obligations common in family-law matters.

Account Information

Account records (name, email, case memberships) are retained for 1 year after the last active case expires or account deletion is requested, then permanently deleted.

Login and Security Logs

Login attempt records and rate-limiting data are retained for 90 days, then automatically purged.

Data Deletion Requests

Account holders may request immediate deletion of specific cases or their entire account by contacting us. Upon verified request:

• Case data and uploaded documents are deleted within 30 days
• Per-case encryption keys are destroyed, making document recovery impossible
• Audit logs are retained per the schedule above (required for compliance)
• Account credentials are immediately deactivated
• Cloud storage objects are purged within 30 days

We recommend exporting all needed data before requesting deletion, as deletion is permanent and cannot be reversed.

Incident Response

In the event of a security incident that may affect your data:

Notification

We will notify affected account holders within 72 hours of confirmed unauthorized access to case data. Notification will include the nature of the incident, data potentially affected, and remediation steps taken.

Investigation

Our incident response process includes immediate containment, forensic analysis, root cause identification, and implementation of preventive measures. We maintain detailed incident logs for post-incident review.

Reporting

Where required by applicable data protection laws, we will file appropriate notifications with regulatory authorities within mandated timeframes.

Backup and Recovery

Production databases are backed up daily with point-in-time recovery capability. Uploaded documents are stored in encrypted cloud object storage with Object Lock protection, ensuring immutability for the configured retention period. Backup integrity is verified regularly through automated restoration tests.

Contact

Data retention, deletion requests, and incident reports: legal@clearsplit.com