> ## Documentation Index
> Fetch the complete documentation index at: https://docs.humanintelligence.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Deletion & Expungement

This page describes how Human Intelligence deletes customer data — both when a contract ends and when a customer asks us to **expunge specific data during the term** (for example, a category of personal data such as compensation or identifiers, data from a particular source system, or records within a specific time range).

Human Intelligence operates as a **data processor** on behalf of each customer (the **controller**). We act on the customer's documented instructions. Individuals (e.g., employees) who wish to exercise data-subject rights should contact the organization that holds their data; that organization can then direct a deletion request to us using the process below, and we will assist.

## 1. Principles

* **Tenant isolation by design.** Each customer's data lives in a dedicated, logically isolated tenant. Deleting or expunging one tenant's data never affects another customer.
* **Deletion is permanent (hard delete).** Our primary analytical store performs hard deletes; deleted data is not retained in a "recycle bin."
* **Complete across the stack, in one window.** A single deletion operation removes the targeted data from every layer that holds it — primary store, derived/semantic layers, caches, search indexes, object storage, and backups — within the same 30-day window (see §5), not just the front-end view.
* **Verifiable.** We can provide written certification of deletion signed by an authorized officer on request.
* **Least retained.** We retain only what we are legally required to retain, plus de-identified or aggregated data that cannot reasonably be linked to an individual.

## 2. Types of Deletion We Support

### 2.1 Full deletion at contract termination or expiration

Upon termination or expiration of the Agreement, and at the customer's choice, we will **delete or return all Customer Personal Data within 30 days** (or a longer period the customer reasonably requests to facilitate migration), except where retention is required by applicable law. Platform, API, and MCP access is disabled, integrations are disconnected, and the customer's tenant and its underlying data — including backups — are removed within the same window.

### 2.2 Targeted expungement during the term (on request)

At any time during the term, a customer may instruct us to expunge a defined subset of their system-of-record data. Supported scopes include, individually or in combination:

* **By data subject** — all records relating to one or more individuals (e.g., a departed employee exercising a right to erasure).
* **By category of personal data** — a class of fields such as direct identifiers (name, email, employee ID), compensation and equity data, demographic/diversity fields, or other **PII** categories.
* **By source system** — all data ingested from a specific connected system (e.g., a particular HRIS or ATS).
* **By time range** — records within a specified effective-date or ingestion-date window (for example, "expunge all data with effective dates in Q1 2025").

Where a request would remove data needed for the platform to function for the remaining population (for example, deleting an identifier that other features depend on), we will flag the trade-offs before proceeding so the customer can confirm scope.

**Access audit logs are preserved.** Expunging data during the term removes the data itself from the platform, but it does **not** delete the audit logs recording who accessed that data before it was deleted. These access records are retained as an immutable security and compliance trail (see §6).

### 2.3 Data-subject requests routed through the customer

Because the customer is the controller, individual access/correction/deletion requests should be raised with the customer. The customer then submits the request to us as a §2.2 expungement (typically "by data subject"), and we assist in fulfilling it within the timelines below.

## 3. What Gets Deleted (Scope Across the Platform)

A deletion or expungement removes the targeted data from each of the following layers that holds it:

| Layer                                | What it holds                                                             | Action on deletion                                                                                                        |
| ------------------------------------ | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **Primary analytical store**         | The customer's governed people/workforce records in their isolated tenant | Hard-deleted (rows, tables, or the entire tenant, depending on scope)                                                     |
| **Semantic & caching layer**         | Modeled metrics, cached query results                                     | Affected definitions/caches invalidated and purged                                                                        |
| **Search & embedding indexes**       | Vector/search indexes used for natural-language and MCP retrieval         | Corresponding index entries deleted                                                                                       |
| **Query history & operational logs** | Records that may reference or contain the data                            | Content purged or minimized where legally permissible; **access audit logs predating the deletion are retained** (see §6) |
| **Object storage**                   | Underlying data files for the tenant                                      | Deleted, including prior versions                                                                                         |
| **Encrypted backups**                | Point-in-time backups                                                     | Deleted within the same 30-day window                                                                                     |
| **Access**                           | API keys, MCP access, user sessions                                       | Revoked (for full termination)                                                                                            |

## 4. How to Submit a Request

1. **Who can request:** a customer's designated administrator or authorized contact.
2. **How:** email [**privacy@humanintelligence.com**](mailto:privacy@humanintelligence.com) (or open a request through your Support channel) with the subject "Data Deletion Request."
3. **What to include:**
   * The scope (termination deletion, or a §2.2 targeted expungement).
   * For targeted expungement: the specific data subjects, categories/fields, source systems, and/or time range in scope.
   * Whether you require **written certification of deletion**.
4. **Verification:** to protect against unauthorized deletion, we verify that the request comes from an authorized contact before we act.

## 5. Timelines

| Request type                | Acknowledgement        | Completion (all copies, including backups)                                                     |
| --------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------- |
| Full termination deletion   | Within 5 business days | Within **30 days** of termination (or agreed migration period)                                 |
| Targeted expungement (§2.2) | Within 5 business days | Within **30 days** of a validated request (complex requests may take longer; we will tell you) |

Deletion is a single operation covering all copies of the targeted data — primary store, derived and semantic layers, caches, search indexes, object storage, and backups — completed within the 30-day window. Until the operation completes, any remaining copies are isolated and protected from further processing and are not used to restore the deleted data.

## 6. Exceptions and Retained Data

We may retain limited data after a deletion or expungement where:

* **Required by law** — e.g., tax, accounting, or other legal-hold obligations. Such data is isolated, access-restricted, and deleted when the obligation lapses.
* **De-identified / aggregated** — information that cannot reasonably be linked to an individual or to the customer may be retained for lawful purposes such as platform operations and reporting.
* **Access audit logs** — for data expunged **during the term**, we retain the audit logs recording who accessed that data prior to its deletion. These form a tamper-evident security and compliance record and are not removed by a term-time expungement. They record access events (identity, time, action) rather than the deleted personal data content itself.
* **Minimal security/audit metadata** — we may retain non-content audit metadata (e.g., that a deletion occurred, when, and by whom) as evidence of compliance. This does not include the deleted personal data itself.

We never retain deleted Customer Data to train or improve any AI or machine-learning model.

## 7. Certification of Deletion

On request, we will provide **written certification of deletion**, signed by an authorized officer, confirming the scope of data deleted, the layers covered (including backups), and the completion date.

## 8. Multi-Tenant Safety

All deletion operations are scoped to a single tenant and validated against that tenant's identifier before execution. Because tenants are isolated and access is enforced by row-level security, a deletion request cannot reach or affect another customer's data.

## 9. Questions

Contact [**privacy@humanintelligence.com**](mailto:privacy@humanintelligence.com) for any questions about this procedure or the status of a request. Retention and deletion obligations are governed by your Data Processing Addendum (DPA) and Master Services Agreement.