Data Handling

The data categories Lorel.ai handles, their retention periods, the automatic deletion rules, and how your data is handled after your contract ends.

Overview

Lorel.ai handles several categories of data: data ingested from external services (via Sources), plus detection events, Incidents, Tasks, the execution history of AI agents and Runbooks, and the Audit Log.

Ingested data, detection events, execution history, and the Audit Log each have a defined retention period, and that data is automatically deleted once the period has elapsed (Incidents and Tasks are the only category with no retention limit — they are kept indefinitely; see the table below for details).

In addition, for 30 days after your contract ends, you enter the data export period, during which you can review your data and reinstate your contract.

• Retention periods tailored to your plan. Retention periods can be configured per data category according to your plan (except Incidents and Tasks).
• Automatic deletion. Data is automatically deleted once its retention period has elapsed (except Incidents and Tasks).
• Data export period at contract end. For 30 days after your contract ends, you can still review existing data. How you reinstate your contract depends on why it ended (see “Data Handling After Contract Termination” below).

Data Categories and Retention Policy Overview

Retention rules vary by data category — including how the retention period is set, whether data is deleted automatically, and whether you can delete it manually — as shown below.

You can change or delete the configuration of Sources, Detection Rules, AI agents, and Runbooks at any time. Accumulated ingested data, detection events, execution history, and other such data are automatically deleted once their configured retention period elapses.

Retention Period and Auto-deletion Rules

Once the retention period configured for a data category elapses, the corresponding data is automatically deleted by the system.

• Restoring deleted data Data that has been automatically deleted, as well as data you delete yourself, is permanently erased and cannot be restored.
• Shortening the retention period If you change a Source’s or Detection Rule’s configuration to a shorter retention period, any existing data that already exceeds the new, shorter period is also deleted automatically.
• Specific retention periods and configuration For the specific retention periods for ingested data and detection events (plan defaults and limits) and how to configure them, see the relevant feature’s configuration screen.

Data Handling After Contract Termination

When your organization’s contract ends — whether through cancellation, simply reaching the end of its term, or forced termination due to non-payment — your data is processed in stages so that you have time to review or migrate it, as follows.

[Contract ends] ➔ [Data export period (30 days)] ➔ [Access ends] ➔ [About 14 days later: data permanently deleted]

1. Data export period (30 days after contract end)

   Once your contract ends, regardless of the reason (cancellation, term expiration, or forced termination due to non-payment), you enter a 30-day “data export period.”

   • What you can do: you can review and check your existing data (ingested data, detection events, Incidents, execution history, and more) in the Lorel.ai app.
   • What’s restricted: you cannot ingest new data or perform write operations such as creating or editing records.
   • Reinstating your contract:
     • If the contract ended because it wasn’t renewed: you can reinstate your contract during that 30-day export period. Please contact us via the contact form for how to do so.
     • If the contract ended through a mid-term cancellation, or through forced termination due to non-payment: reinstating the contract requires a separate individual inquiry and procedure.

2. Access ends, then data is permanently deleted (30 days later, plus about 14 more days)

   Once the 30-day data export period ends, you first lose access to your organization and projects. After a further period (currently about 14 days), the associated data is then permanently deleted by the system.

   • Data subject to deletion: ingested data, detection events, Incidents, Tasks, AI agent and Runbook execution history, Source configurations, Runbook definitions, and more
   • Records subject to legal retention: records related to your contract and payments, such as invoices, continue to be retained for the legally required period even after the data deletion.
   • Audit Log handling: the Audit Log is not subject to deletion at contract end or when your organization’s data is deleted. Its own retention period, counted from the time each record was created (about 13 months), continues to apply after your contract ends, and the log is deleted once that period elapses.

Limitations

• For ingested data (incoming events and metrics) and detection events, there is no feature to manually delete individual records (they are deleted automatically once their configured retention period elapses).
• There is no feature to bulk-download past data after your contract ends. Despite the name “data export period,” at this time you retrieve data manually from individual screens. Please make sure to review and retrieve anything you need well before the 30-day data export period ends.

Related Features

• Rules Overview (how to configure the retention period for detection events)
• Incidents / Tasks Overview (deleting individual Incidents and Tasks)
• Audit Log (retention period for the Audit Log)
• Security Overview (encryption of stored data)
• AI Agents Overview (AI agent execution history)
• Runbooks Overview (Runbook execution history)
• Restrictions When Payment Is Delayed (details on the conditions and timing of forced contract termination due to non-payment)