Skip to content

Data Handling & Deletion Policy

Purpose. Ensure customer and personal data is deleted when it should be, kept out of places it does not belong, and not leaked. Soon is a GDPR data processor; deletion obligations flow from customer DPAs. Absorbs the former Data Masking and Data Leakage Prevention policies.

1. Scope

All customer and personal data Soon processes, across production, backups, dev/test environments, and SaaS tools. Physical media is out of scope — Soon holds none; all data lives in cloud services.

2. Policy

2.1 Deletion

  • Customer data must be deleted on verified customer request or at contract end, within the timescale set by the DPA. Customer data is deleted 90 days after contract end (confirmed 2026-08-08), matching the Records Retention & Protection Policy. TODO(owner: Olaf): verify the standard DPA states the same period, so the contract and the policy agree.
  • Deletion covers production data stores and propagates to backups as they expire within the backup-retention window (see the Backup & Availability Policy); deleted data is not restored except transiently during a disaster-recovery restore, after which deletions are re-applied.
  • Secure deletion relies on cloud-provider mechanisms (AWS deletion and encrypted-storage key destruction); no physical destruction processes exist or are needed.
  • Deletions must be recorded (request, scope, date, confirmation).

2.2 Data masking and non-production use

  • Production data must not be used in development or test environments unless masked or anonymised so individuals and customers are not identifiable. TODO(owner): confirm current practice — synthetic seed data or masked copies?
  • Screenshots, demos, and support reproductions must use test data, not identifiable customer data.

2.3 Leakage prevention

  • Access to customer data follows least privilege per the Access Control Policy.
  • Customer data must not be placed in SaaS tools that are not approved per the Cloud Service Policy (e.g. no exporting customer data into personal or unapproved apps, including AI tools).
  • Soon does not store payment-card data; payments are handled by Stripe, and card data must never enter Soon systems, logs, or tickets.
  • Suspected data leakage must be reported immediately per the Information Security Event Reporting Procedure.

3. Roles & responsibilities

  • Engineering team: executes deletions, maintains masking/seed-data practice.
  • Security responsible: verifies deletion records, approves masking approaches, handles leakage reports.
  • All personnel: keep customer data inside approved tools.

Change log

Version Date Author Comments
0.1 2023-10-23 Olaf Jacobson First draft document
0.2 2026-07-18 Andrea Cardinali Rewritten lean and Soon-specific (ISMS overhaul); absorbs the Data Masking and Data Leakage Prevention policies