Data retention

Gobierno › Retención de datos (Governance › Data retention) decides, for the whole organization, how long each kind of data stays active (visible and usable in the portal) and what happens when that time is up:

Archive (default): the record leaves the platform as a .zip in an open format —one JSON file per record, with its attachments— stored in Zoan Cloud or in your own container (Amazon S3 or compatible, Cloudflare R2 or Azure Blob Storage). Archived data is kept until you delete it: it serves audits, legal requests and your industry’s retention obligations.
Delete: the record is removed without an archive. This only happens if you choose it for that kind of data, and every deletion is written to the audit log.

Viewing the page requires the retention:read permission; changing it and requesting the full export, retention:manage. Both come with the Owner and Administrator roles; the Auditor role can view and download.

To handle a person who asks for their data to be erased, use Personal data.

Kinds of data and default times

Data	What leaves	Default active days
Executions and their logs	The finished execution with its step-by-step log and viewing sessions.	30
Finished queue items	Items in a final state (successful, failed, business exception, abandoned, retried or deleted).	120
Closed assistant conversations	The conversation with its messages, actions and attachments.	90
Finished Zoan Flow cases	The completed or cancelled case with its start form, steps, events and files.	90
Closed human tasks	The decided, cancelled or expired task with its form, its response and its files.	90
IDP documents	The original file, its pages and its extraction.	90 from upload
Storage files	Files in the buckets of people and robots.	Kept with no expiry
Audit log	Audit log events.	730 (2 years)

The default action is archive for every kind, except storage files, which are kept by default.

The active time of executions, queue items, conversations and human tasks is capped by the days your plan includes; Zoan Flow cases by the plan’s case retention. The page shows the cap for each kind. IDP documents, storage files and the audit log are not capped by the plan; documents and files count against your plan’s storage.

Data still in use never leaves: an execution that belongs to an open Zoan Flow case, a queue item an open case depends on, or a task of an open case stays until the case ends, and a file attached to an open task stays while the task is open.

Human tasks

The whole closed task leaves: the form that was shown, the response and the attached files. When the task took a file from a bucket, the .zip carries a copy and the original stays in its bucket, under that bucket’s policy.

IDP documents

The 90 days count from the document’s upload. If the environment or the robot set a retention when uploading it, that date wins, whether it is before or after the 90 days. The .zip carries the original file and the extraction; rendered pages are generated again from the original, so they are only deleted.

Storage files

By default, bucket files are kept: a robot or a person can keep using them whenever they need. If you prefer them to leave, choose Archivar (Archive) or Borrar (Delete) after the days you want, for every bucket or for one bucket. The rule applies to files; folders and what the system stores for a conversation, a task or a case leave together with that conversation, task or case.

Forms

What is submitted in a form is kept in the task that asked for it (response and files) or in the Zoan Flow case it started (start form and files), and leaves with them: it has the same retention as the task or the case.

Execution media

Files a robot uploads to a bucket during an execution —for example, a screenshot deliberately taken in exception handling— are linked to that execution. When the execution is archived, its .zip carries a copy of those files, so the batch is complete for an audit; the original stays in its bucket under that bucket’s policy.

The Vencidos hoy (Due today) column shows how many records are already past their active time and will leave on the next run.

Rules per process, queue or bucket

When a process, a queue or a bucket needs a different time, add a rule under Por proceso o por cola (Per process or queue): its executions, items or files follow those days and that action instead of the general rule. For example, keep payroll executions for 90 days and archive the rest after 30, or delete the files of a working bucket after 30 days and keep everything else. Removing the rule puts the process, queue or bucket back on the general rule.

Archive destination

Destination	What you need	Plan storage
Zoan Cloud	Nothing: it is the default. You download each batch from the page.	Counts against your plan’s storage until you delete the batch.
Amazon S3 or compatible	Bucket, region (or the https endpoint of a compatible provider), access key and secret key.	Not used.
Cloudflare R2	Account ID, bucket, access key and secret key.	Not used.
Azure Blob Storage	Storage account, container and a container SAS token.	Not used.

Own containers accept an optional prefix. The key needs write and read permission (and delete, if you want the connection test to clean up): Zoan Cloud writes each batch, reads it back to verify it, and only then removes the data from the platform.

Probar conexión (Test connection) writes a small file under .zoan-archive-test/, reads it and deletes it. Probar y guardar (Test and save) only saves the destination when the test passes. The secret key or token is stored encrypted and never shown again; leave it empty to keep the saved one while changing another field.

Own containers are reached only over https and through public internet names.

Archive quota in Zoan Cloud

What is archived in Zoan Cloud counts against your plan’s storage. If a batch does not fit, the organization’s automatic archive is paused and the due data stays active on the platform: nothing is deleted or lost. While it is paused:

The page shows a notice with the space used and the quota.
Owner and Admin get an email, at most once a week.
The pause and its end are written to the audit log (retention.archive_paused and retention.archive_resumed).
The deletions the organization chose keep working.

To keep archiving, make room or get more: delete archived batches you already downloaded, free up files, move the archive to your own container (it uses no quota) or ask for more storage. The pause lifts on its own on the first run where the batch fits.

How a batch leaves

Once a day, Zoan Cloud goes through each kind of data:

It groups what is due by kind, month and process or queue (or flow, for Zoan Flow cases) into batches.
It builds the .zip and uploads it to the destination.
It reads it back and checks the sha256 of the .zip, the manifest and every record.
Only then it removes the records from the platform and records the batch in the history and the audit log (what, how many, where).

If the destination fails or the check does not match, nothing leaves the platform: the batch shows as Reintentando (Retrying) with the reason, and the same batch is picked up the next day.

The Lotes (Batches) section lists each batch with its date, kind, period, records, size, destination and status. Batches in Zoan Cloud can be downloaded with a temporary link and deleted (frees the space; cannot be undone). Batches in your own container are downloaded and deleted from that container.

.zip format

Each batch is stored at:

<kind>/<year>/<month>/<process-or-queue>/<batch>.zip

<kind> is executions, queue_items, conversations, flow_instances, human_tasks, documents, storage_files or audit. The process, queue, flow or bucket segment (its name plus the start of its id, e.g. facturacion-3f2a1b9c) only appears for executions, queue items, cases and storage files; records without one go to sin-proceso (or sin-cola, sin-flujo, sin-bucket). In Zoan Cloud the path starts with archive/<organization id>/; in your own container, with your prefix.

Entry	Content
`manifest.json`	Format (`zoan-archive`, version 1), organization, kind, scope, period, date, record and attachment counts, and each entry’s path, size and sha256.
`records/<id>.json`	One record with everything it had on the platform.
`attachments/<record id>/<file>`	The record’s files, when it has any: conversation attachments, case or task files, execution media, the document’s original or the bucket file.

The sha256 of the whole .zip is kept in the history and in the audit log, so you can prove the batch did not change.

Exporting the audit log

Besides the archive after 2 years, you can take the audit log to your own system:

In Gobierno › Auditoría, pick Desde (From) and Hasta (To), the format (CSV or JSON) and Exportar (Export).
With the Zoan Cloud API: GET /v1/audit-events with from, to, event_type, entity_type and cursor pagination. To pull it continuously, query with from set to the date of the last event you already have.

Full organization export

Under Gobierno › Retención de datos › Exportación completa (Full export) you request a copy of all the organization’s data in a single .tar.gz, which opens with any tool, without Zoan:

The data: one JSON file per table, one row per line.
The organization’s files.
The batches archived in Zoan Cloud.

It includes no secrets or credentials (passwords, tokens, keys). Requesting it requires retention:manage. It is built in the background, one at a time per organization; when it is ready, whoever requested it gets an email and downloads it from the page with a temporary link. Each export is kept for 7 days.

End of contract

When the organization no longer has an active subscription (cancelled or expired), it has 90 days to take its data:

The full export is built automatically and the Owner gets an email to download it; that export is kept until the end of the period.
During the period people can keep signing in to Zoan Cloud and request a new export.
A reminder arrives 15 days before the end of the period.
If the organization has an active subscription again, the end of contract is cancelled and everything stays as it was.

When the period ends, the organization is scheduled for deletion.