Data Retention & Offboarding Policy

This policy explains what CyberDefenseDesk LLC d/b/a Valley CISO does when a client cancels. It applies alongside your service agreement and, for healthcare clients, the Business Associate Agreement. If they conflict, the signed agreement controls.

1. Stop and revoke

• Monitoring, scheduled scans, automated alerts, and reports stop.
• Client portal access for every user at your organization is removed.
• Our administrative accounts, API connections, and remote-access tools on your systems are revoked. Where agents are installed on your devices, we uninstall them or give you written steps to do so.

2. Your copy of your data

Before your workspace is archived you can ask for an export of your reports, policies, network map, and signed agreements. After archiving, contact us and we will send anything we still retain under section 4.

3. What we delete

• Network maps, device inventories, discovered vulnerabilities, and synced monitoring data
• Onboarding intake answers, site and property records, alert settings, and schedules
• Portal memberships and sign-in links for your organization

4. What we keep, and why

Retained records are access-restricted to our staff and are not used for marketing. We delete them when the applicable legal or contractual retention period ends. Protected health information is returned or destroyed as the BAA requires, or kept protected under the BAA where return or destruction is not feasible.

• Invoices, orders, and payment records — tax and accounting law
• Signed contracts, work orders, BAAs, and acknowledgments — proof of what was agreed
• Support tickets, delivered reports, and audit logs — dispute defense, insurance, and security accountability

5. Confirmation

When offboarding is complete we email the account contacts a confirmation that lists what was deleted and what was retained. Questions or deletion requests: privacy@valleyciso.com.