📘

Organizations Only

A business account is required to use this feature.

What is Data & Retention

Data & Retention answers one question for your Organization: how long things are kept, and where they are stored. You will find it in the Organization section of the sidebar, alongside Network Settings and Identity & Access.

The page is split into four groups:

• Storage - which region physically holds your Analytics data, and which countries count as home
• Retention - how long query logs and aggregated statistics survive
• Automatic Cleanup - when idle IPs, Endpoints and Clients are removed
• Delete Data - one-off, permanent clears

Some of these are restricted to Organization Owners, so Admins and Viewers see a shorter page. See Members and Permissions for what each permission level can do.

Storage

Storage Region

The Storage Region is the region that physically holds your Organization's Analytics data. Choose the jurisdiction that suits your compliance requirements.

• Owners choose the region from a dropdown. Admins and Viewers see the current region as read-only text.
• If a region is already selected and you switch to a different one, you are asked whether to Keep Data or Delete Permanently. Data already stored is not migrated to the new region.
• The dropdown is disabled while SIEM log streaming is enabled, because changing region breaks an existing stream. Contact the Control D support team first, see Integration: General Purpose.

Nothing else on this page works until a Storage Region is set: retention rows read Select storage region first, and the Delete Data buttons stay disabled.

Home Countries

Home Countries mark up to 3 countries as your Organization's expected traffic sources. Statistics uses them for the Home Country Traffic panel, which shows the share of queries that originated in those countries. Anything outside them stands out as unusual.

The dropdown groups countries into recently active locations and all locations, so you can pick from where your Endpoints have actually been seen.

Retention

📘

Owners Only

The Retention group is shown to Organization Owners. Admins and Viewers do not see it.

Retention controls how long Analytics data survives in your storage region.

• Raw Logs Retention - how long individual DNS queries in the Activity Log are kept. Options range from 1 day up to 1 month.
• Aggregated Analytics Retention - how long the aggregated counts behind Statistics are kept. Options range from 3 days up to 1 year.

A few rules apply to both:

• The list of options is capped by the maximum retention available for your storage region, so you may see fewer choices than the full range above.
• Aggregated retention can never be shorter than raw retention. Raising raw retention past the current aggregated value pushes the aggregated value up with it.
• Extending a retention period applies immediately.
• Shortening one permanently deletes everything older than the new window, so it asks for an explicit confirmation before anything is applied.

Retention only governs how long stored data is kept. What gets stored in the first place is chosen per Endpoint by its Analytics level.

Automatic Cleanup

Automatic Cleanup removes resources that have had no DNS activity for the period you choose. Each row accepts Never, 30 days, 60 days or 90 days:

• Authorized IPs - authorized IP addresses, see IP Management
• Endpoints - Endpoints that have stopped resolving
• Clients - Device Clients metadata

Choosing Never turns off inactivity-based removal for that resource: those records are kept indefinitely, no matter how long they sit idle.

Only Owners can change these thresholds. Admins and Viewers see the current values, but the dropdowns are disabled for them.

Delete Data

📘

Owners Only

The Delete Data group is shown to Organization Owners. Admins and Viewers do not see it.

Two permanent clears live here. Both open a confirmation dialog, and the Delete button in that dialog stays disabled until you tick the acknowledgement checkbox. Neither can be undone.

• Clear Analytics Data - permanently clears all of your stored Analytics data in the current storage region, across every Endpoint.
• Clear Admin Logs - permanently clears all of your stored Admin Logs across your Organization and its Sub-Organizations. This row is only shown to parent Organizations; Sub-Organizations do not get it.

🚧

It may take up to 48 hours to completely delete your data.