Security & Compliance
Data retention and backups
ArkCloud keeps clinical, financial and audit records in the production database and does not delete them automatically. A scheduled job removes a few kinds of short-lived operational data. Archival to cold storage is built but not running, and backups are kept for 14 days.
Written for: Compliance officers · Security reviewers · Administrators
What is deleted automatically
| Field or control | What it means |
|---|---|
| Expired patient-portal sessions | Deleted 90 days after they expire. Runs daily. |
| Activity events | Deleted after 2 years. Runs weekly. |
| Integration job-run records | Deleted after 1 year. Runs monthly. |
| Ask ArkCloud help conversations | Deleted after your organisation's Ask ArkCloud retention period (90 days unless an administrator changes it). Scheduled daily. |
| Patients, accounts, claims, payments, clinical records, documents | Not deleted automatically. They stay in the database until removed by a user or by ArkCloud on request. |
| Audit logs | Not deleted. The application cannot delete them; no retention period has been set yet. They are removed only if the organisation is deleted directly in the database. A user with PHI access history cannot be deleted at all (migration 20261008300000), so that history is kept. |
Cold-storage archival
ArkCloud has an archival service that writes records to low-cost object storage, and the monthly retention run attempts to archive accounts that have been closed for seven years. The hosted service has no archival destination configured, so nothing is archived today. Archival of audit logs exists only as a manual operator action.
Running an archival job, or moving archived records to the deep-archive tier, is restricted to ArkCloud's platform operators. The operator names one organisation and the job runs only within that organisation's data. An organisation's administrators can see archive statistics and policies, list archived records, and request, check and download a restore; they cannot start archival themselves. These actions are available through the API, not a screen.
Backups
| Field or control | What it means |
|---|---|
| Frequency | One full database dump per night. No incremental backups. |
| Kept for | 14 days. |
| Location | On the same machine as the database. There is no off-site copy. The backup script can send an encrypted copy off the host, but no destination is configured. |
| Failure alerts | None. A failed backup is not reported automatically. |
| Encryption | None. Designated fields inside the dump are field-encrypted; the dump itself is not. |
| Verification | Each dump is hashed and read back. A full restore has been rehearsed once, into an isolated test database; a restore into production has never been needed or performed. |
| Recovery point | Up to about 24 hours of data could be lost. |
Settings that do not change retention
At the end of a contract
There is no self-service way to export or destroy all of an organisation's data, and no documented destruction procedure yet. Agree return and destruction terms - including what happens to copies in the 14-day backups - in the contract and the Business Associate Agreement.