Data retention policy
Last updated: Nov 4, 2026
For Fluid Attacks, the integrity of the services that it gives to its users is very important. Thus, when Fluid Attacks deletes a group on its platform, it keeps specific data with valuable information about the history of that group. It always respects and guarantees the confidentiality of this information. This practice is essential to keep the integrity of the operations and services of Fluid Attacks. It makes the ability of Fluid Attacks to give a quality service stronger. As the data use policy says, Fluid Attacks uses the information only to give its service.
Fluid Attacks keeps these fields in its database after it deletes a group on its platform:
- From the organization and group created:
- Creation date
- Language
- Country
- State info: active services, modification dates
- Code languages information
- Sprint length and start date
- From registered repositories:
- Creation date
- Code languages info
- Type: Git repository, URL, IP
- From the ToE surface (lines, ports):
- Attack date
- Attacker email
- First attack date
- Whether it has vulnerabilities
- Discovery date
- Whether the ToE was present in the Surface section before group deletion
- Last date the ToE was present in Surface
- For input ToEs: discoverer email
- For line ToEs:
- Lines of code
- Attacked lines
- Sorts risk level
- From the vulnerability types
found (also known as weaknesses):
- Title
- Severity:
- CVSS v4.0 vector string and CVSS-BT score
- CVSSF
- Requirements
- Pentester email
- Status information
- Whether Sorts was involved in detection
- Information on reattacks and verifications
- From the vulnerabilities found (also known as locations):
- Type: input, line, port
- Severity
- CVSS v4.0 vector string and CVSS-BT score
- CVSSF
- Machine method, if applicable
- Information regarding status, treatments and verifications
- Custom level (also known as priority, defined by the user)
- Technique used for detection
- File extension for code vulnerabilities
- From the events in the group:
- Creation date
- Creator's email address
- Event date
- Pentester email
- Solution reason
- Solving date
- State info
- Type
Fluid Attacks does not store information about these items:
- Personal information: email, names, phone numbers, and other personal data. Fluid Attacks deletes all external emails that are in the fields above.
- Repositories
- Credentials
- URLs
- Endpoints