Data Retention

Data Retention lets organization owners and admins on Enterprise plans control two things:

Retention periods — how long execution logs, soft-deleted resources, and Chat data are kept before they are permanently deleted.
PII redaction — masking personally identifiable information out of your workflow data at up to three points: workflow input, block outputs, and logs.

Both are configured once at the organization level and apply to every workspace, with optional per-workspace overrides for workspaces that need different rules.

Setup

Go to Settings → Organization → Data retention in your workspace.

The page shows your retention policies as a list:

The Organization row (tagged Default) holds the settings that apply to every workspace without its own override.
Each workspace override row below it applies to one or more specific workspaces.

Open a row to edit it, or click Add override to create a workspace override. Each policy has a Retention section, and — when PII redaction is enabled — a PII redaction section.

Retention periods

Each policy has three independent retention settings, each with the same set of options: 1 day, 3 days, 7 days, 14 days, 30 days, 60 days, 90 days, 180 days, 1 year, 5 years, or Forever.

Setting a period to Forever means that category of data is never automatically deleted. On a workspace override, each field can also be set to Inherit from organization to fall back to the organization default for just that field.

Log retention

Controls how long execution logs are kept.

When the retention period expires, log records are permanently deleted, along with any files associated with those executions in cloud storage. This covers:

Workflow execution logs
Background job logs (deployed APIs, schedules, and webhooks)

Soft deletion cleanup

Controls how long soft-deleted resources remain recoverable before permanent removal.

When you delete a workflow, folder, knowledge base, table, or file, it is initially soft-deleted and can be recovered from Recently Deleted. Once the soft deletion cleanup period expires, those resources are permanently removed and cannot be recovered.

Resources covered:

Workflows
Workflow folders
Knowledge bases (and their documents)
Tables
Files
MCP server configurations
Agent memory
Chat conversations

Task cleanup

Controls how long Chat data is kept, including:

Chat conversations and run history
Run checkpoints and async tool calls
Inbox tasks

Each setting is independent. You can configure a short log retention period alongside a long soft deletion cleanup period, or any combination that fits your compliance requirements.

PII redaction

When PII redaction is enabled for your organization, each policy gains a PII redaction section that masks personally identifiable information — names, emails, phone numbers, credit-card numbers, national IDs, and more — from your workflow data. Sim detects and masks PII with Microsoft Presidio; each match is replaced with a placeholder token such as <EMAIL_ADDRESS>.

Redaction is configured per stage — the point in a run where masking is applied. Select a stage, then choose which entity types and custom patterns to redact for it:

Stage	What it does
Logs	Redacts workflow logs when they are persisted. Observability-only — the workflow still runs on the original data.
Workflow input	Redacts the workflow input before execution. The workflow runs on the masked data, which may change its output.
Block outputs	Masks every block output before the next block reads it. Runs in-flight and may change output and execution performance.

The Workflow input and Block outputs stages alter what the workflow computes on, not just what is stored. Redacted data is masked during the run and may affect workflow output. Enable them only where that trade-off is acceptable.

Entity types and language

For each stage, choose the entity types to redact from the searchable grid. They are grouped as:

Common — person name, email, phone, credit card, IP address, location, date or time, URL, IBAN, crypto wallet, nationality/religious/political group, medical license, VIN
United States — SSN, passport, driver's license, bank account, ITIN
United Kingdom — NHS number, National Insurance number
Other regions — Spanish (NIF, NIE), Italian (fiscal code, driver's licence, VAT code, passport, identity card), Polish (PESEL), Singaporean (NRIC/FIN, UEN), Australian (ABN, ACN, TFN, Medicare), Indian (PAN, Aadhaar, vehicle registration, voter ID, passport), and Finnish (personal identity code) identifiers

The Block outputs stage is restricted to regex- and checksum-based recognizers, to support in-flight masking without name-model detection. Types that need name-model detection — person name, location, date or time, and nationality/religious/political group — are not offered for that stage.

Detection is language-aware: pick the language whose recognizers should apply. English, Spanish, Italian, Polish, and Finnish are supported, and the grid filters to the identifiers available for the selected language.

Some recognizers match loosely and over-redact — US Social Security Number, US bank account number, and Date or time have no checksum and match aggressively. Enable these only where false positives are acceptable.

Custom patterns

Beyond the built-in entity types, each stage can redact anything a regular expression matches — employee IDs, internal URLs, ticket numbers. Give each pattern a name, a regex, and a replacement token; every match is replaced with the replacement text wrapped in angle brackets (e.g. EMPLOYEE_ID → <EMPLOYEE_ID>).

Per-workspace overrides

Retention and PII redaction are configured at the organization level and apply to every workspace by default. When a workspace needs different rules, add a workspace override.

An override targets one or more workspaces (a workspace can belong to only one override).
Each retention field either sets its own period or inherits the organization value.
PII redaction on an override is either Inherit (use the organization's redaction) or Override (workspace-specific). Choosing Override replaces the organization's redaction rules entirely for that workspace — it is not merged stage-by-stage.

Removing an override returns its workspaces to the organization defaults.

Defaults

By default, retention settings are unconfigured — no data is automatically deleted in any category, and no PII is redacted, until you configure it. Setting a retention period to Forever has the same effect as leaving it unconfigured, but makes the intent explicit and lets you change it later without configuring from scratch.

Common Questions

Only organization owners and admins can configure data retention settings. On Sim Cloud, the organization must be on an Enterprise plan.

No. Deletion runs on a scheduled cleanup job. Data is deleted when the job next runs after the retention period has elapsed — not at the exact moment it expires.

No. Once the soft deletion cleanup period expires and the cleanup job runs, resources are permanently deleted and cannot be recovered.

The organization policy applies to every workspace that does not have its own override. Add a per-workspace override to give specific workspaces different retention periods or PII redaction rules.

The next cleanup job will delete any data that is older than the new, shorter period — including data that would have been kept under the previous setting. Shortening the period is irreversible for data that falls outside the new window.

The Logs stage does not — it only masks data as it is persisted, so the workflow runs on the original data. The Workflow input and Block outputs stages do: they mask data in-flight, so the workflow computes on the redacted values, which can change its output.

1 day (24 hours).

5 years, or Forever — the same option list applies to all three settings.

Self-hosted setup

Retention periods

NEXT_PUBLIC_DATA_RETENTION_ENABLED=true
DATA_RETENTION_ENABLED=true

Once enabled, retention settings are configurable through Settings → Organization → Data retention the same way as Sim Cloud.

Scheduling the deletion pass

DATA_RETENTION_ENABLED permits deletion; it does not perform it. Deletion runs when a scheduled request reaches one of three endpoints, each authenticated with a bearer token equal to CRON_SECRET:

Category	Endpoint
Execution and job logs	`GET /api/logs/cleanup`
Soft-deleted resources	`GET /api/cron/cleanup-soft-deletes`
Chats and Chat runs	`GET /api/cron/cleanup-tasks`

Neither shipped deployment schedules these three endpoints — not the Helm chart, not Docker Compose's cron service. An operator who sets DATA_RETENTION_ENABLED=true alone still deletes nothing. Add them to cronjobs.jobs, or call them daily from an external scheduler.

# Use the value already configured as CRON_SECRET on the app — a token
# generated here and not installed there returns 401.
curl -H "Authorization: Bearer $CRON_SECRET" \
  https://sim.example.com/api/logs/cleanup

Each call fans the work out as background jobs. Trigger.dev is not required: when it is not configured the dispatcher runs the cleanup chunks inline instead of enqueuing them, so deletion completes on a default self-host.

PII redaction

PII redaction runs against a standalone Presidio service. Deploy it (see apps/pii) and point Sim at it:

# The Presidio service exposing /analyze and /anonymize
# Helm — setting pii.enabled wires this for you, and a manual value is then
# ignored. Set it by hand only for an external Presidio with pii.enabled:
# false. The bundled Service is <release>-sim-pii, or <release>-pii when the
# release name already contains "sim".
PII_URL=http://<service>.<namespace>.svc.cluster.local:5001
# Docker Compose — no shipped file defines a PII service. Add one to the
# same project, then use its service name.
# PII_URL=http://pii:5001

All PII stages are configurable under Settings → Organization → Data retention.

Data Retention

Common Questions

On this page