Data Retention
How long FormsFort keeps data.
FormsFort retains redacted operational metadata for diagnostics, not raw submission payloads. The retention worker automatically deletes data older than the configured window. Individual forms can override the global retention period.
Default retention
60 days
Configurable via FORMSFORT_METADATA_RETENTION_DAYS
Per-form overrides
1–365 days
Set from the dashboard or control-plane API
Cleanup frequency
At least daily
Run worker:retention on a scheduled cron
Raw submission bodies
Never stored
Only field names, hashes, and redacted metadata
Retention by data category
| Category | Database tables | Default | Configurable | Cleanup method |
|---|---|---|---|---|
| Submission metadata | submission_events | 60 days | 1–365 days | Deleted by the retention worker (worker:retention) based on per-form retentionDays override or global FORMSFORT_METADATA_RETENTION_DAYS. |
| Rate-limit events | rate_limit_events | 60 days | 1–365 days | Deleted by the retention worker alongside submission metadata. |
| Email delivery records | email_deliveries | 60 days | 1–365 days | Deleted by the retention worker after the configured window. |
| Webhook delivery records | webhook_deliveries | 60 days | 1–365 days | Deleted by the retention worker after the configured window. |
| Google Sheets delivery records | google_sheets_deliveries | 60 days | 1–365 days | Deleted by the retention worker after the configured window. |
| Integration delivery records | integration_deliveries | 60 days | 1–365 days | Deleted by the retention worker after the configured window. |
| Upload failure events | upload_failure_events | 60 days | 1–365 days | Deleted by the retention worker after the configured window. |
| Upload objects (non-pending) | upload_objects | 60 days | 1–365 days | Non-pending rows deleted by the retention worker. Pending objects expired by the upload cleanup worker (worker:uploads). |
| Audit logs | audit_logs | Indefinite | No | Retained indefinitely for compliance. Manual review and pruning may be performed by operators. |
| Account data | users, sessions, accounts | Indefinite | No | Anonymized upon completed account deletion request. Sessions and credentials removed in the same transaction. |
| Suppression list | suppression_entries | Indefinite | No | Retained until manually removed by an admin. |
| Upload objects (storage) | S3-compatible object storage | Indefinite | No | Expired by the upload cleanup worker based on reservation TTL. Temporary download links use FORMSFORT_UPLOAD_DOWNLOAD_TTL_SECONDS (default: 1 hour). |
How retention works
Form-level override check
The retention worker first checks if the form has a retentionDays override set from the dashboard. If present, that value (1–365 days) is used for that form's data.
Global default fallback
If no per-form override exists, the worker uses FORMSFORT_METADATA_RETENTION_DAYS, which defaults to 60 days.
Automated deletion
The worker deletes submission_events, rate_limit_events, email_deliveries, webhook_deliveries, google_sheets_deliveries, integration_deliveries, upload_failure_events, and non-pending upload_objects rows older than the effective retention window.
Upload object cleanup
Pending upload reservations are left for the upload cleanup worker (worker:uploads) so stale objects are expired before retention deletes their metadata. Actual file bytes in S3-compatible storage are deleted by the cleanup worker based on the reservation TTL.
Backups
Encrypted PostgreSQL backups are taken at least daily. Backup retention is managed by the hosting infrastructure provider. Restore drills are run against isolated databases to verify backup integrity and migration consistency. Backup data follows the same retention policies as production data.
Data deletion requests
Users can request account deletion from the dashboard profile settings. For other data deletion requests or questions about retention, contact [email protected].