Skip to the page
CloudArq
Sign inStart free
Sign inStart free

What We Store

Everything CloudArq keeps about you, why, and for how long. None of it is sold or used for advertising.

Last updated
18 October 2026
Contact
[email protected]
What we keep, why, and for how long
WhatWhyHow long
Your email address, and your password as a bcrypt hash, never the password itselfTo sign you in and to write to you about your account.While the account exists, and deleted within 30 days of closure.
Your two-factor secret, encrypted, and your backup codes, kept in a form that cannot be read backTo check the second step of every sign-in.While the account exists, and deleted within 30 days of closure.
A sign-up whose address is not yet confirmedTo complete the sign-up when you open the confirmation link we emailed.Valid for 24 hours; deleted at the next sign-up after it expires.
A password reset linkTo let the owner of the address choose a new password.Valid once, for 30 minutes; deleted at the account's next password reset after that.
A session, and the __Host-session cookie that identifies itTo keep you signed in.Ends after 1 hour without use, or after 24 hours at most.
The step between your password and your code, and the __Host-challenge cookie that identifies itTo complete a sign-in after the password step.Valid for 10 minutes; deleted when it is used, or at the account's next sign-in after that.
Security events: sign-ins, sign-outs, lock-outs and changes to your account, with the timeTo keep accounts safe and to find out what happened if one is misused.12 months; afterwards only a tamper-evidence fingerprint that identifies no one.
The analysis of each scan you upload: the cloud account's ID and name, each role's name, and who can get into each (outside accounts, CI identities such as GitHub organisations, repositories and branches, sign-in providers, and cloud services), as the engine answered it in your browser, with a fingerprint of your file, and, when AWS refused the collector a call, AWS's message about it, with (removed) in place of the session, user or device name it gives for whoever ran the collector (a role's own name stays as AWS wrote it); and when a call went unanswered, the collector's reason. Whether the account belongs to an AWS Organization. If it does: the Organization's ID, its management account's ID and its feature set. If AWS refused that read, we keep that it was refused. What the engine works out from your file: which owners count as yours, which it asks you about, each role's path, which roles AWS made for its own services, and what each of your answers would change. This can name people, such as a user in one of your policies. The file itself stays on your computerTo show you who can get into your accounts.Free: the latest read of each account. Deleted when you remove the account, and with your workspace.
Beta, Starter: every change from the last 90 days; Organisation: from the last 13 months; up to 90 reads of each account. Deleted when you remove the account, and with your workspace.
The owners you declare as yours: GitHub organisations, AWS accounts and AWS Organizations, SAML providers and issuersTo mark them as yours, in your browser: at once in the scans you have already uploaded (or to say why one cannot be), and in every scan you upload next.Until you change or remove them. Deleted with your workspace.
Server logs. For an upload we refused or that stalled: your workspace's ID and how many bytes arrived.To run the service and find the cause of a fault.30 days.
Error reports at Sentry, from our server: the error's type and where in our code it happenedTo learn that something broke, and where.30 days.
Backups of the database, encrypted before they leave the serverTo recover from a failure.30 days, rolling.
Email you send to [email protected]To answer you.12 months after the conversation ends.
Billing recordsPaddle sells the plans and holds the payment details; we keep the records the law requires.As long as Israeli tax law requires.
Page views, counted by PlausibleTo know which pages are read.Kept only as counts, which identify no one.
Your theme, cloudarq.theme, in your own browser's storageTo remember Dark when you choose it. Nothing is stored while you keep the default, Light.Until you choose Light again or clear this site's data.

Three cookies: two set when you sign in, to sign you in, and one Cloudflare sets to tell people from bots.

__Host-session, set by our sign-in service: HttpOnly, Secure, SameSite=LaxIt keeps you signed in, and lasts until the session ends: 1 hour without use, 24 hours at most.

__Host-challenge, set by our sign-in service: HttpOnly, Secure, SameSite=StrictIt carries a sign-in from your password to your code, and lasts 10 minutes.

__cf_bm, set by CloudflareIt tells people from bots, and lasts until 30 minutes pass without activity.

Scripts on a page cannot read either of our two. Our pages set no cookies of their own, and Plausible sets no cookie.

Nothing on this site needs your consent, so there is nothing to ask.

All three cookies are strictly necessary, which the law exempts from consent: our two for the sign-in you asked for, and Cloudflare's to tell people from bots as it carries each request to us. Your theme is stored only when you choose one, and only in your browser. Plausible counts page views without storing anything on your device. If you prefer not to be counted, block plausible.io; every page works the same without it.

What you paste into the Explorer, and any credential to your cloud.

The Explorer analyses your policy inside your browser tab, and keeps it in the part of the page address after the #, which browsers never send. We never ask for an access key, a token or a role in your cloud, so none can reach us.

Our Privacy Notice explains who processes each item and what you can ask us to do with it. Send questions to [email protected].