Document deletion and recovery policy

Delete

Move a document to the Deleted tab. Reversible. Nothing is destroyed and no data leaves our systems.

Restore

Bring a deleted document back into the documents list, exactly as it was when it was deleted.

Recovery window

The period a deleted document stays restorable. Set per workspace, 30 days unless an admin changes it, and never shorter than 1 day or longer than 180.

Permanent deletion

Destroying the document, its stored files and everything attached to it. Irreversible, by us and by anyone else.

Audit trail

The append-only, hash-chained record of what happened to a document. Described in clause 7 and in the security overview.

Any member of a workspace can delete a document in it. The document leaves the documents list and appears in the Deleted tab, which shows who deleted it, when, and how many days are left before it is destroyed.

Deleting is recorded in the document's activity feed and in its audit trail, with the account that did it. There is no way to delete a document quietly.

Signatures already collected are unaffected. A document that was completed before it was deleted is still a completed document when you restore it, with the same signed file, the same certificate of completion and the same hashes.

A deleted document stays restorable for the whole of the recovery window. During that time any member can restore it in one click from the Deleted tab, and members can still open it and download the original and signed files.

A document is destroyed permanently in one of three ways: its recovery window closes and the daily maintenance job destroys it; an admin destroys it early from the Deleted tab; or an admin empties the Deleted tab.

Only admins and owners can destroy a document before its window closes. Ordinary members can delete and restore, but cannot make anything unrecoverable. The worst a member can do is something an admin can undo.

• The document record is deleted from the database.
• Its recipients, fields, signature images and captured values go with it.
• Its activity feed goes with it.
• The original file, the signed file and the certificate of completion are deleted from encrypted object storage.

Backups are a separate system with their own rotation, described in the security overview. A permanently deleted document may persist in an encrypted backup until that backup ages out on its normal cycle. Backups are never used to restore an individual document, only to recover from a disaster affecting the whole service.

The only automatic destruction is the one described above: documents whose recovery window has closed. We do not delete documents because a workspace is inactive, because a plan was downgraded, or because a document is old. A document you have not deleted stays until you do.

Signing links and one-time tokens are the exception, and they are not documents: they are revoked when used, cancelled or expired, and purged on the same daily job.

Every one of these actions is written to the audit trail with the account that performed it, the time, and the network address it came from.

The audit trail. Nothing else.

A document's audit trail is append-only and hash-chained: each entry carries the hash of the one before it, which is what makes the record evidence rather than a list somebody could have edited afterwards. Entries are never rewritten and never removed, including when the document they describe is destroyed. What remains is the record of what happened: that the document existed, that it was sent, viewed, signed, downloaded, deleted and destroyed, by whom and when, together with the fingerprints of the files.

The audit trail does not contain the document itself. It holds no page content, no field values, no signature images and no attachments. Those are destroyed with the document. What it holds about a person is their name, their email address, the network address they acted from, and what they did.

If you need personal data removed from an audit trail, which is a data subject request rather than a document deletion, write to privacy@dropthedoc.xyz. We handle those under clause 12 of the privacy policy, which explains what we can anonymise and what we cannot.

Before deleting anything you may need later, download it. From any document you can take the original file, the signed PDF, and the certificate of completion. From the activity page you can export the full event log as a CSV, filtered however you like.

All of that stays available while a document is in the Deleted tab, so a document deleted by mistake can still be exported while you decide whether to restore it.

If we change how deletion works in a way that shortens what we keep or reduces what you can recover, we will give account holders at least 30 days' notice by email before it takes effect. Clarifications and corrections are published here with the version bumped.

Questions about this policy go to support@dropthedoc.xyz. Questions about personal data go to privacy@dropthedoc.xyz.