Tenant governance
Retention policy, DPDP data-subject rights and tenant provisioning. These controls act on the whole tenant, not on a single scan.
Acting on tenant
Resolved from your API key. Every operation below is scoped to this tenant and cannot reach another one.
How long CertForge keeps each class of tenant data. Floors are enforced by the server — evidence artefacts and audit logs cannot be shortened below the certification minimum.
Recorded, not yet enforced.CertForge stores this policy as your tenant's retention decision, but the server reports that nothing deletes data on the schedule below. Do not treat this page as evidence that data has been removed.
India's Digital Personal Data Protection Act gives the data principal a right to a copy of their data and a right to erasure. Both act on the entire tenant and are rate-limited by the server.
Right to access
Queues an export of every record CertForge holds for this tenant. Non-destructive and safe to run before an erasure.
Right to erasure
Soft-deletes every scan job, finding, tool run and evidence artefact belonging to this tenant, immediately. There is no undo in CertForge.
Waiting for the tenant to resolve before this can be armed.
Provision a new customer tenant and its first API key. A tenant is the isolation boundary — organizations and projects live inside one.