Data handling
What we hold, where, for how long, and what we will never do with it.
What we hold
To produce a badge Propel receives the cardholder's name, photograph, the fields printed on the card (employer, title, an identifier), and a delivery address. For managed device inventory we hold device serials and the recipient of each allocation. We hold account details for the people who use our portals. We do not receive payment card numbers, government identifiers or health information as part of the badge service.
Retention — enforced nightly
| Data | Deleted | How |
|---|---|---|
| Badge artwork and rendered badge files, cardholder photo | 30 days after the badge ships | Nightly purge deletes the object and clears the reference; an audit row records the run |
| Shipping documents (the sheet that carries the name and address) | 90 days after shipping | Same purge |
| Carrier labels | 30 days after shipping | Same purge |
| All cardholder data for an order | No later than 1 year after the order (Privacy Policy §7) | Stored artifacts are covered by the purge above. Deletion of the remaining order records at one year is a manual step today; a scheduled job is being built |
| API request logs | Metadata 30 days; bodies 7 days (30 for test keys) | Nightly prune; bodies are stored redacted |
| Sandbox (test-key) orders | 30 days | Nightly purge |
The object store has no versioning, so a deletion leaves no copy. The database keeps a 6-hour point-in-time recovery window and no long-lived snapshots.
Where it lives
The database and object store are in the western United States; application servers run in the United States. See the subprocessor list for each provider, its region and what it processes.
Encryption
All connections use TLS. Data is encrypted at rest by the database and object-store providers. Passwords are hashed; API keys are stored as SHA-256 hashes and shown once; sessions are signed; webhook payloads are signed with a per-endpoint secret that rotates with a 24-hour overlap.
What we will never do
- Use client content to train machine-learning models — a binding commitment in our Terms of Service and Privacy Policy, and enforced internally by our AI Usage Policy.
- Sell or share cardholder data with anyone but the subprocessors listed, for the purpose listed.
- Keep cardholder data past the schedule above because it might be useful later.
If something goes wrong
We contain first, preserve evidence (including suspending the purge), and notify affected clients within 72 hours of becoming aware of a breach. Report anything to security@propelbsc.com.