The records behind the result.

Supply records only within your agreed workspace scope. Read the privacy notice and service terms before onboarding. These controls are not a compliance certification.

What Ropely stores

Account email and workspace membership, original imports and normalized source records, coverage declarations, rules, saved checks, reviews and operational billing references. Use stable application account IDs instead of names or email addresses where possible. Do not include card details or unrelated records in exports.

What stays in your environment

The customer-run PostgreSQL exporter uses your database role in your environment. It sends selected grant snapshots; your database login is not sent to Ropely. A connected Stripe credential is stored encrypted by the application. Ropely does not issue grants, change balances or repair purchases.

Who can see the evidence

Access is authenticated and scoped to workspace membership. Owners manage sources, rules, billing and deletion; members can inspect evidence and participate in reviews. Test and live records are kept in separate scopes. Invite only people who should see the workspace’s records.

Developer and assistant access

Owner-created developer keys are hashed, expire after 90 days and are scoped to one workspace and mode. Revocation, ownership loss and database restore stop access. MCP tools are read-only but can return evidence to your selected assistant provider. Create a separate read-only key and use synthetic data first.

Retention and exports

The application implements age-based retention with notice and export windows, plus durable erasure records. Automated retention remains disabled in restricted staging; workspace deletion remains available. Export findings before deleting a workspace. Session and temporary authentication data expire automatically. The backup command expires recognized local archives after 30 days. Private staging backups in Cloudflare R2 also have a 30-day lifecycle policy. Signed deletion records are retained separately so an older backup cannot be treated as the current deletion history.

Deleting a workspace

The owner reauthenticates and confirms the workspace name in Settings. Access is blocked immediately, local source credentials are removed and monitoring stops. Purging waits at least 24 hours and for billing cancellation to be confirmed. A failed or blocked request stays visible. Deletion is permanent.

Encrypted backups may retain earlier data until expiry. A separate signed deletion journal is used to reapply deletions during recovery. Deletion receipts and recovery records are retained. Deleting Ropely records does not erase Stripe’s records or copies already exported by other people.

Closing an account

Transfer or delete owned workspaces first, then use account closure. Sessions and memberships are removed and the account email is replaced. Contributions and attribution in other workspaces can remain; closure does not erase every historical mention.

Before production use

Restricted staging, sandbox payments, encrypted R2 recovery and a replacement-host exercise have been verified with synthetic evidence. Customer acceptance remains separate. No uptime, compliance or recovery-time guarantee is offered. Customer-data onboarding requires the agreed processing scope and verified production operations.