Data retention

You can set data retention periods for each organization. The organization settings page gives you three ways to control how runZero manages your asset and scan data. runZero expires data in a nightly batch job, using the current settings of each organization in your account.

The runZero Platform keeps data for up to 1 year by default. For active subscriptions, the retention period can be increased to a maximum of 3 years. The runZero Community Edition is limited to 30 days of retention.

Stale asset expiration

Stale asset expiration purges out-of-date information from runZero: assets that haven’t been seen in the specified number of days are deleted automatically. The deletion task runs once per day.

The limit applies to online and offline assets alike. If an asset was online when last scanned but hasn’t been scanned (or imported through a connector) in the specified number of days, its information is stale and runZero deletes it. It’s like running the asset search last_seen:>Xdays (where X is a number) and deleting the results.

You can set stale asset expiration at both the Organization and Site levels; the lower value wins. To disable it, set the number of days to zero.

Offline asset expiration

Offline asset expiration clears out information about assets that no longer exist on the network: assets that are offline and haven’t been seen in the specified number of days are deleted automatically. Online assets are untouched. The deletion task runs once per day.

This setting applies to offline assets discovered by runZero scans. Assets with only connector/import data fall under stale asset expiration.

The asset state (alive:false) determines whether an asset is offline. The last_seen value then measures the asset’s age against the configured threshold; on its own, that value doesn’t classify an asset as offline. The cleanup also requires scan-backed assets (scanned:true) with a runZero scan source.

This is useful for guest wireless networks or networks with short DHCP leases. It’s closest to running the asset search last_seen:>Xdays AND alive:false AND scanned:true (where X is a number) and deleting the results.

Stale asset expiration runs separately and can remove the same assets sooner when its threshold is lower.

To disable offline asset expiration, set the number of days to zero.

Stale integration attribute expiration

Stale integration attribute expiration clears out data from integrations that no longer report an asset: attributes the integration hasn’t reported in more than the specified number of days are deleted automatically, and assets left with no data sources are removed too. The deletion task runs once per day.

You can keep the latest attribute set per integration, even when it is older than the threshold.

To disable stale integration attribute expiration, set the number of days to zero.

Stale vulnerability expiration

Stale vulnerability expiration removes out-of-date vulnerability data: vulnerabilities not updated in more than the specified number of days are deleted automatically. The deletion task runs once per day.

To disable stale vulnerability expiration, set the number of days to zero.

Scan data expiration

Scan data expiration controls how long runZero keeps the raw data and metadata for Scan and Import tasks. If your organization has a maximum data retention policy for cloud services, use this setting to force the removal of any data older than a given number of days. The default of 365 keeps one year of historical scan data.

Event records

Account-level event records (under Alerts -> Events) are always kept for one year. To keep copies longer than that, export and archive them through the API.

AI threads and artifacts

Data from the AI section of the console has fixed retention windows that you can’t change:

• AI threads (conversations, private to the user who started them) are removed 180 days after their last use. Every new turn resets the clock, so an active thread never expires; renaming one does not.
• Unshared AI artifacts are removed with the thread that produced them, attached files included. Shared artifacts are kept indefinitely while shared; unsharing one restores the thread-derived expiry.
• AI run records (the job and its streamed event log) are temporary: about 15 minutes while a run is active and 24 hours after it ends. The durable results are the thread and its artifacts.

Cleanup runs daily. Users can delete their own threads and artifacts at any time, and deleting a thread removes its unshared artifacts immediately.

Custom integration script versions

Custom integrations keep the most recent 25 versions of their script. Older versions are pruned as new ones are saved, and deleting a custom integration deletes its version history.

Data deletion after account termination

When your runZero Platform subscription ends, runZero deletes your data according to the table below.

If you downgrade from a runZero Platform subscription to the free Community Edition, runZero deletes your data according to the table below.