Data retention policy
do not explicitly delete user content: responsibility of user.
User account closure - immediate disassociation with all identifying links to any project that may still exist.
Data archiving and removal policy
system backups are only source of archive. User deletion of data will cause backups to not have that data anymore. Backup retention is snapshot of varying length of time; max 12 months.
Data storage policy
All data stored encrypted-at-rest in AWS only.
App/service has sub-processors
yes
Guidelines for sub-processors