CyberAuthority · business service
Data Retention Information
What SimulatedPhishManager retains, what deletion controls remove, and how cancellation differs from data deletion.
Updated
Current retention approach
SimulatedPhishManager, operated by CyberAuthority, retains information used to administer organizations, operate authorized simulations, provide results, and manage billing and service history.
The current application does not automatically purge database records after a fixed number of days. This page describes the controls and behavior available today; it does not establish a new automatic deletion period or guarantee deletion from every provider.
Records and deletion behavior
| Category | Details |
|---|---|
| Organization and administrator records | Organization and application-account information remains until removed through authorized controls or a reviewed removal request. Application-account removal and identity-provider account removal are separate actions. |
| Employee rosters and campaign activity | Authorized administrators can remove employee records. Employee-linked tracking and delivery records are removed with that employee record in the application database. Removing an employee is not confirmation that all usage, billing, provider, or exported records have been deleted. |
| Templates and images | Templates and their associated application-stored images remain until removed through authorized controls. Templates referenced by campaigns may require review of those dependencies before removal. |
| Billing, usage, consent, and audit history | These records are not automatically cleared by employee deletion, subscription cancellation, or a monthly usage-window reset. Recipient email identifiers can remain in usage history to enforce limits and avoid duplicate delivery. Some history can also remain after an organization’s operational records are removed. |
| Reported messages | Bounded text, local findings, limitations and necessary metadata remain until removed through authorized controls; there is no automatic report retention period. System administrators can delete a report, which removes its content from the live application database, cancels unsent assessment replies, and removes the associated reply outbox recipient, confirmation and provider metadata. An already accepted email cannot be recalled; external sender and mailbox provider retention controls apply separately. Reassignment invalidates pending reply confirmation and never re-enrolls attempted replies. Removing mailbox connection settings does not delete report content. Only a content-free mailbox ID / UIDVALIDITY / UID processing receipt remains to prevent silent re-import. Simulation tracking events are separate and are not deleted with an assessment. Raw MIME and attachment binaries are not retained by default. No historical backfill is performed. Messages are not deleted from the reporting mailbox; provider and administrator retention controls apply separately. |
| Provider records, logs, backups, and exports | Email, authentication, payment and AI providers can retain their own records. Logs, backup copies, and downloaded reports are not necessarily removed when a live application record is deleted. Their retention must be considered separately; this page does not promise a fixed provider or backup purge deadline. |
Organization and administrator records
Organization and application-account information remains until removed through authorized controls or a reviewed removal request. Application-account removal and identity-provider account removal are separate actions.
Employee rosters and campaign activity
Authorized administrators can remove employee records. Employee-linked tracking and delivery records are removed with that employee record in the application database. Removing an employee is not confirmation that all usage, billing, provider, or exported records have been deleted.
Templates and images
Templates and their associated application-stored images remain until removed through authorized controls. Templates referenced by campaigns may require review of those dependencies before removal.
Billing, usage, consent, and audit history
These records are not automatically cleared by employee deletion, subscription cancellation, or a monthly usage-window reset. Recipient email identifiers can remain in usage history to enforce limits and avoid duplicate delivery. Some history can also remain after an organization’s operational records are removed.
Reported messages
Bounded text, local findings, limitations and necessary metadata remain until removed through authorized controls; there is no automatic report retention period. System administrators can delete a report, which removes its content from the live application database, cancels unsent assessment replies, and removes the associated reply outbox recipient, confirmation and provider metadata. An already accepted email cannot be recalled; external sender and mailbox provider retention controls apply separately. Reassignment invalidates pending reply confirmation and never re-enrolls attempted replies. Removing mailbox connection settings does not delete report content. Only a content-free mailbox ID / UIDVALIDITY / UID processing receipt remains to prevent silent re-import. Simulation tracking events are separate and are not deleted with an assessment. Raw MIME and attachment binaries are not retained by default. No historical backfill is performed. Messages are not deleted from the reporting mailbox; provider and administrator retention controls apply separately.
Provider records, logs, backups, and exports
Email, authentication, payment and AI providers can retain their own records. Logs, backup copies, and downloaded reports are not necessarily removed when a live application record is deleted. Their retention must be considered separately; this page does not promise a fixed provider or backup purge deadline.
Cancellation is not data deletion
Subscription cancellation stops renewal under the Cancellation Policy. Sending entitlement and dashboard access follow the applicable paid-period and recovery rules. Cancellation, expiration, payment failure, or a payment adjustment does not itself constitute a request to erase all organization data.
Organizations should export any results they need while they have authorized access and separately request removal when required. Downloaded copies remain under the control of the person or organization that exported them.
Monthly usage resets do not erase history
A monthly usage window determines the recipient capacity and sending allowance for that window, including for annually billed subscriptions. A new window changes the allowance calculation; it does not delete the underlying delivery or usage history.
Removing and re-importing an employee, changing providers, or changing a subscription does not reset that recipient’s recorded usage in the current window. Uncertain delivery outcomes remain reserved for review to avoid duplicate simulation emails.
Requesting review or removal
Employees should contact their organization’s administrator about organization-managed information. Company administrators should use their existing CyberAuthority service contact for platform-level removal requests and specify the organization, record categories, and requested scope.
Requests require appropriate authority and may require identity verification. Removal from the live application, removal from an external provider, and removal from backups or previously exported reports are separate matters.
Billing, consent, usage, audit, security, dispute, or other records may need separate review before removal. No fixed completion deadline or universal erasure guarantee is stated on this page.
Guidance for organization administrators
- Inform employees about authorized simulations, tracking, and reporting before using the service.
- Keep recipient information accurate and remove unnecessary operational records through the available controls.
- Limit access to reports and retain exported copies according to your organization’s own requirements.
- Review retention separately with any SMTP, reporting-mailbox, or other provider your organization configures.
- Do not interpret cancelling billing, resetting an allowance, or removing one record as confirmation of complete erasure.