Trust center
What we keep, and what deletion removes.
A deletion request for a verified email removes the rows below. Audit entries keep only a hash of who acted.
| Data | Where | Removed on deletion |
|---|---|---|
| account record | Convex, users | Yes |
| breach lookups | Netlify Blobs, audits | Yes |
| account event timeline | Netlify Blobs, audits | Yes |
| mobile push tokens | Netlify Blobs, audits | Yes |
| monitored identities | Netlify Blobs, watchlists | Yes |
| billing/subscription record | Netlify Blobs, subscriptions | Yes |
| insurance policy records | Netlify Blobs, policies | Yes |
| uploaded vault documents | Netlify Blobs, documents | Yes |
| phishing-simulation records | Netlify Blobs, simulations | Yes |
| concierge chat history | Netlify Blobs, messages | Yes |
| concierge conversation summaries | Netlify Blobs, memories | Yes |
| insurance claims | Netlify Blobs, claims | Yes |
| extension bearer tokens | Netlify Blobs, audits | Yes |
| session credential epoch | Netlify Blobs, audits | Yes |
| password-account email verification challenges | Convex, emailVerifications | Yes |
| seat threat-catch ledger (AE29 "ledger") | Netlify Blobs, audits | Yes |
| reported-phish records / per-seat reputation cache (AE29 "reputation cache") | Convex, orgReports | Yes |
| device check-in records | Convex, orgSeats | Yes |
| pending and tombstoned invites | Convex, orgInvites | Yes |
| org membership / seat status | Convex, orgMembers | Hashed or expired |
| audit trail (AE29 "the audit event holds only the hash") | Convex, orgAudit | Hashed or expired |
The browser extension keeps a few counters on your own device: how many threats it detected, what it did about each one, and whether its warning was followed. They never reach SYBA servers, and uninstalling the extension clears them.