Skip to content

Data Handling & Deletion Policy

Purpose. Ensure customer and personal data is deleted when it should be, kept out of places it does not belong, and not leaked. Soon is a GDPR data processor; deletion obligations flow from customer DPAs. Absorbs the former Data Masking and Data Leakage Prevention policies.

1. Scope

All customer and personal data Soon processes, across production, backups, dev/test environments, and SaaS tools. Physical media is out of scope — Soon holds none; all data lives in cloud services.

2. Policy

2.1 Deletion

  • Customer data must be deleted on verified customer request or at contract end, within the timescale set by the DPA. Customer data is deleted 90 days after contract end (confirmed 2026-08-08), matching the Records Retention & Protection Policy. Verified 2026-09-09: the published Data Processing Agreement (soon.works/legal/dpa §9) commits to deletion within 90 days of termination, with a 30-day retrieval window first and backups overwritten within 30 days of deletion from live systems. Contract and policy agree.
  • Deletion covers production data stores and propagates to backups as they expire within the backup-retention window (see the Backup & Availability Policy); deleted data is not restored except transiently during a disaster-recovery restore, after which deletions are re-applied.
  • Secure deletion relies on cloud-provider mechanisms (AWS deletion and encrypted-storage key destruction); no physical destruction processes exist or are needed.
  • Deletions must be recorded (request, scope, date, confirmation).

2.2 Data masking and non-production use

  • Production data must not be used in development or test environments unless masked or anonymised so individuals and customers are not identifiable. Current position (2026-09-09): the owner confirms the legacy Azure staging environment holds no production data. That has not been verified against the database itself — S-493 is open to check it directly and to mask or split anything found. Until it closes, this rests on an assertion rather than evidence, and the customer-facing EU-residency statement depends on it being true.
  • Screenshots, demos, and support reproductions must use test data, not identifiable customer data.

2.3 Leakage prevention

  • Access to customer data follows least privilege per the Access Control Policy.
  • Customer data must not be placed in SaaS tools that are not approved per the Cloud Service Policy (e.g. no exporting customer data into personal or unapproved apps, including AI tools).
  • Soon does not store payment-card data; payments are handled by Stripe, and card data must never enter Soon systems, logs, or tickets.
  • Suspected data leakage must be reported immediately per the Information Security Event Reporting Procedure.

3. Roles & responsibilities

  • Engineering team: executes deletions, maintains masking/seed-data practice.
  • Security responsible: verifies deletion records, approves masking approaches, handles leakage reports.
  • All personnel: keep customer data inside approved tools.

Change log

Version Date Author Comments
0.1 2023-10-23 Olaf Jacobson First draft document
0.2 2026-07-18 Andrea Cardinali Rewritten lean and Soon-specific (ISMS overhaul); absorbs the Data Masking and Data Leakage Prevention policies