Data retention policy
While you are a customer, we retain aggregated data indefinitely. Sensitive employee data such as Date of Birth and Addresses are retained for one year.
If you leave Pyn, all data is removed from our production systems. Data retained in backups is isolated and removed within 3-months.
Data archiving and removal policy
Pon HQ Ltd Pty will fully remove customer data after the contract ends or if customers request their data to be deleted within a quarter.
Data storage policy
The Pyn Application stores two kinds of data: service data and secure data.
Service data is user and account metadata, troubleshooting, accounts receivable and billing, and related information necessary for the company to know in order to service an account. Service data is kept confidential but is not subject to the encryption controls below that render information readable to the company.
The company does not hold the encryption keys for any secure data. Instead, these keys are maintained by the AWS service. Secure data remains encrypted in transit and storage.
Secure data is protected by these algorithms and protocols:
- TLS 1.2 or later
- AES-256-GCM encryption
Secure data is protected using encryption via the AWS Key Management Service (KMS). Master Keys are stored and maintained by AWS and are never exposed outside of AWS infrastructure. AWS KMS is used for encrypting production data in DynamoDB and customer secrets.
Data center location(s)
United States
Data hosting details
Cloud-hosted on AWS
App/service has sub-processors
no