How long are documents and audit logs kept?

Each program sets its own retention period, chosen from 24, 60 or 84 months. The same setting covers onboarding documents and their audit logs, so the evidence of a review lives as long as the files it concerns.

When the period ends, documents and audit logs are removed automatically. The removal is logged like every other action on the platform, which gives you a record that the policy was applied. Your team does not need to track expiry dates or delete files by hand.

Choosing the right period

The right duration depends on the obligations you answer to, which vary by country, by license and by the requirements of your payment partners. Anti-money-laundering rules, for example, often require records to be kept for a set period after the end of a business relationship. Review the obligations that apply to each program with your compliance team, then set the duration that matches.

Because the setting sits at program level, an operator running several programs can apply different periods to each one. A reseller or a client program in another jurisdiction can follow its own policy without affecting the rest of your portfolio.

Throughout the retention period, documents stay encrypted under a managed key, in storage reserved for each merchant, on European infrastructure.