Data Retention
This page describes what the platform keeps, for how long, and how it is deleted. Where a retention period is not set by the product itself, it is set in your customer agreement.
What the platform stores
- Configuration and metadata from your connected clouds
- Findings, and the asset and attack-path graph built from them
- Your users' account details
- An audit log of reads of the product's data views: who, what, when, from where, and the result
- Where a cloud needs a stored credential (for example an OCI API key or an Alibaba Cloud access key), that credential, kept in AWS Secrets Manager and encrypted with AWS KMS. For AWS no secret is stored — Onam assumes your role.
Posture scanning and data classification read configuration and metadata. They do not read or keep the contents of your files, objects or database rows.
What is kept only for the length of a task
- AI Code Fix: when you run a fix, the repository is cloned for that run and the clone is deleted when it finishes. The Git token is used for that request only and is never stored or logged.
- Agentless workload scanning: scan machines and disk snapshots run inside your own account. Leftover scan resources are removed automatically after a set number of hours.
While you are a customer
Your data is kept while your organisation is active, so history and trends stay available. Specific retention periods for individual data types, and any export you need, are set in your customer agreement.
When you leave
Customer data is kept for 30 days after a customer deactivates, then deleted. If you need an export before then, ask us before you deactivate.
Backups
Databases are backed up with AWS Backup, in the region agreed with you.
Where your data is stored
Onam runs on AWS, in the region agreed with you — US, Europe, India or other regions — so you can meet your own compliance requirements.
Questions
Write to security@onamsecurity.com for retention or deletion questions, or sales@onamsecurity.com to discuss terms for your agreement.
Next steps
- Trust Center — how Onam connects, what it stores, encryption, and sub-processors
- Service Levels — where service levels are agreed
- API Reference — pull findings programmatically