Skip to main content
Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented This policy defines baseline retention windows and deletion behavior for core hosted data classes.

What this policy answers

  • Which hosted data classes are retained and for how long
  • How deletion is enforced in active systems and backups
  • How retention ownership differs in self-hosted deployments

Current state (as of March 5, 2026)

Retention and deletion controls described on this page are active in the hosted deployment model.

Retention schedule (hosted default)

Data typeRetention
Account and workspace recordsWhile active
Telemetry metadata required for operationWhile workspace is active
Backups30 days

Deletion behavior

  • On account or workspace deletion, data is removed from active systems within 30 days.
  • Backup copies are deleted as backup-retention windows expire.

Hosted vs self-hosted scope

AreaTero-hostedSelf-hosted
Retention enforcementTero-operatedCustomer-operated
Backup lifecycle controlsTero-operatedCustomer-operated
Infrastructure-level retention configurationTero-defined baselineCustomer-defined

Exceptions and governance

Retention exceptions require documented risk acceptance, approval, and time-bound remediation. Questions: