Data retention and metadata boundary
Answers are deleted 7 to 90 days after a poll closes. Here is what goes with them, what stays until the poll is deleted, and what outlasts it.
- Security reviewers
- 4 min read
- Updated Oct 14, 2026
- Reviewed by Security
Heads up: the retention window decides when answers are deleted. It's separate from the rule that admins see nothing below the poll's minimum group size, three at the lowest (see Viewing results); this page lists every other thing we keep about a poll, so you don't have to take "we avoid metadata" on trust.
InviziPoll separates response ciphertext retention from operational and audit metadata so your workspace can enforce poll-level deletion schedules without losing security logs. This page explains what is deleted when a poll's retention window expires and what operational metadata remains.
#Admin-configured retention
When creating a poll, the Data retention after poll closes (days) setting offers 7, 14, 30, 60, or 90 days. Once that period has passed after the poll closes, its answers are permanently deleted.
The same scheduled sweep deletes, at the same moment:
- Every stored answer (ciphertext).
- Reply mailboxes and threads. A conversation never outlives the answers it replied to.
- Shared slices. A link handed to a manager never outlives the data behind it, even if its own expiry is later.
#What stays until the poll is deleted
These are kept with the poll after its answers are purged. A poll can be deleted once it has no answers, and deleting it removes all of them.
Aggregates and records you created:
- Series trend snapshots. When a wave in a recurring pulse series unlocks, the admin's browser archives its counts and distributions, encrypted to that wave's poll key, so the trend line survives the purge.
- Batch history. An encrypted record of which release groups the admin has seen, used by the batched-release panel. How batched release works.
- The published results document, if you published one. It's an aggregate, encrypted, and served on the public results page while that page is on. Turning public results off removes it.
- You said, we did commitments, which are admin-written text like a poll title.
Counters and distribution records, none of which is linked to any answer:
- How many answers arrived on each day (the dashboard chart), and how many came by each route (personal invite, open link, open link with a code).
- For access codes: a one-way hash of each code, and whether and when it was used.
- For personal invites: each invited address as a one-way hash, whether that invite's ballot was issued, and the day it was issued (a date, not a time). A hash isn't the address, but anyone holding a list of addresses could check them against it.
- For employee ratings, a masked work address and the day for anyone recorded as having left.
- For polls with roster cuts, the grouped attribute values each invitee's ballot was given (for example a department), stored against that invitee's hashed address.
- The invite log: masked recipients (like
j•••@acme.com), a hash of each address for "Check an address", and when each invite was sent. - Hashes of spent ballots, so a ballot can't be used twice.
#What outlasts the poll
- Rate-limit counters, briefly. To slow ballot stuffing, the submit endpoint keeps a counter per network and poll. It records that a network submitted to a poll, never what it answered, and it isn't linked to any answer. They're keyed by a hash of the IP address that rotates daily, not the address itself, and are deleted on a schedule once their window has passed, whether or not the poll still exists.
- Audit events. Admin actions (for example who changed a setting or published results) are recorded with metadata only. They never contain answers.
- Email suppressions. If an address bounces or complains, we keep it on a suppression list so we stop sending to it, across all workspaces.
#What the platform doesn't store
A stored answer is its poll and its ciphertext. There's no timestamp, submission order, IP address or identity on it, and admins receive released answers shuffled. We don't keep per-answer timelines, IP-derived rankings, or a per-ballot audit trail in anything admins can see.
#Tenant purge
Deleting a workspace permanently removes its polls, answers, folders, keys held for it, and everything in the lists above that belongs to its polls, without decrypting anything. The accounts of the people in it are detached from it rather than deleted. Audit events and email suppressions aren't part of a workspace and remain. Rate-limit counters aren't either, and they're deleted when their window passes.