What we store about you. How to get a copy of everything. How to cleanly leave. Self-service from the portal or the CLI - no support ticket, no quota cost, no friction.
The full inventory from docs.bcdock.io/security/data-handling ↗. Each item is in the export bundle.
| Class | Storage | Region |
|---|---|---|
| Identity, account, billing | Managed relational DB (Azure) | Primary region |
| Environment records, usage, audit | Same database instance | Primary region |
| Provisioning logs | Same database instance | Primary region |
| Hibernation backup blobs | Azure Storage (per-region) | Env's region |
| Per-env BC admin passwords | Azure Key Vault (per-region) | Env's region |
| Shared TLS certificate | Azure Key Vault (core) | Global |
| What | Retention |
|---|---|
| User account / Company | While active · 30-day grace · anonymise forever |
| Hibernation backup blobs | 7-day soft-delete after env delete · gone |
| Session tokens | 7 days from issue · wiped at anonymisation |
| Email codes (OTP) | ~10 min · single-use · hashed at rest |
| Provisioning logs | Indefinitely · not personal data, env-keyed |
| Audit trail | Indefinitely · anonymised when user is |
| Subscription / billing history | Indefinitely · financial-record requirement |
| Salted email hash post-anonymisation | Indefinitely · trial-abuse suppression |
Primary region vs your environment's region. The region you pick (US or AU) is where an environment runs, together with its hibernation backups and admin password. Your account and control-plane data - identity, billing, usage, audit - lives in BCDock's primary region, currently Australia (Sydney), which may differ from your environment's region. We never copy that data into other regions.
GDPR Article 15 / APP 12 self-service. Full mechanics at docs.bcdock.io/security/data-export ↗.
Portal button or `bcdock me export --wait`. Idempotent - a second call returns the same request id.
Background job runs under your company context, packs CSVs into a ZIP, uploads to per-region storage.
Mint a SAS URL: read-only, single blob, 24-hour TTL. TLS required.
SAS link emailed to your account address. Download anytime in the 24h window.
We chose anonymisation over hard-purge because a hard purge would destroy audit trails, financial-record integrity, and provisioning telemetry - none of which is personal data, all of which is operationally needed. Below is exactly what happens, and when.
All envs hibernated immediately - active billing stops. Account marked pending. Confirmation email sent. 30-day grace begins.
Personal data overwritten in place. Hibernation blobs hard-deleted. Session and OTP state wiped. Status deleted.
Audit trail preserved by reference to an anonymised account. Subscription history kept (financial record). One salted hash retained for trial-abuse suppression.
Disclosed up front so you know exactly what crosses the +30d boundary and why.
Audit records, usage history, env provisioning history reference the account by ID.
GDPR Art. 17(3)(e) - re-registration detection and trial-abuse suppression. Salt lives in Key Vault, never rotates.
Prevents a second free trial on re-registration with the same email.
Same FK-integrity reason as the account ID.
Type your account email to confirm:
Email recycling. If your email later becomes the property of another person (Gmail recycles abandoned addresses; custom-domain ownership changes), the salted hash will match on first sign-in and the anonymised account will restore to them. Whoever controls the inbox controls the account - same threat model as password-reset-via-email everywhere.