Data Retention and Deletion Policy

How long Webforta keeps data and how deletion works.

Retention periods

Monitoring measurements and scan results: up to 400 days (display limited to your plan’s history period).
DNS and header snapshots: up to 400 days; the latest snapshot is kept while the website exists.
Imported Cloudflare security events: 90 days.
WordPress connector file-scan results and activity log: 90 days. The latest inventory snapshot is kept until the connector is disconnected.
Alert channels: until you remove them. Notification delivery records: 180 days. Domain registration data: overwritten on each daily check and deleted with the website.
Shield firewall event log (blocked, challenged and would-block requests, with IP addresses stored only as keyed hashes): 90 days. Shield hourly traffic counters: 400 days; per-hour top countries, paths and rules: 90 days.
Notifications log: 180 days.
Audit log: 2 years.
Sessions: until expiry or 30 days after sign-out.
Contact form messages: 1 year.
Payment webhook records: 90 days. Billing records required for tax purposes are kept by the payment provider and as required by law.

Removing a website deletes its scans, findings, monitoring data, incidents and reports immediately.
Deleting your account deletes your user record, sessions and any organization in which you are the only member, including all of its data.
Database backups (Cloudflare D1 Time Travel) may retain deleted data for up to the backup window configured by the operator. [Confirm and document the window.]