Data Retention & Incident Response

Last updated 15 October 2026 · Owner: Koana Works administrator · Reviewed at least once a year

1. What we keep, and for how long

• Organization records (members, meetings, minutes, decisions, documents, finances, projects):
  • kept while the organization uses Koana, because continuity across officer handovers is the purpose of the service;
  • removing something archives it rather than erasing it, so records can be restored and audited.
• Personal notes and private comments: kept until the author archives them. They are never handed to the next officer.
• Connected-account data:
  • Google, Zoom, Facebook, Instagram and Threads keys are kept only while the connection is active.
  • When an officer disconnects, the keys are revoked with the provider where it supports this, and deleted immediately.
  • Saved meeting links, event IDs and page names stay with the related Koana record as part of the organization's history.
• Removal requests from Meta: when a person removes Koana from Facebook or Threads, or asks Meta to delete their data, we delete the keys and clear the saved page name and picture automatically.
• Operational logs and error reports: kept for up to 90 days.
• Security scan reports: kept for up to 90 days.

2. Deletion

• Organizations: may ask us to delete their organization and its records. We confirm the request with an officer, then delete the data within 30 days.
• Backups: data in provider backups expires on the providers' normal cycles.
• Individuals: may ask to have their own personal information removed at contact@koanaworks.com, or through data deletion. Where an organization must keep a record, such as minutes that name an attendee, we tell you what remains and why.

3. Incident response

An incident is any event that could compromise the confidentiality, integrity or availability of data in Koana, for example a leaked secret, unauthorized access or a vulnerable dependency being exploited.

1. Detect and record: from automated scans, error monitoring, provider alerts or a report. We log what is known and when.
2. Contain: revoke and rotate affected secrets and tokens, disconnect affected integrations, block access, or take features offline as needed.
3. Assess: work out what data, organizations and people are affected, and how.
4. Fix: correct the cause, deploy the fix and confirm it with testing.
5. Notify:
   • Affected organizations are told without undue delay, and within 72 hours of confirming that personal data was affected.
   • Platform partners are informed where their users or data are involved (for example Zoom, Google or Meta).
   • Authorities are informed where the law requires.
6. Learn: after each incident we write a short review and update our controls.

4. Contact

Questions or requests: contact@koanaworks.com.