# Data Management


The **Data Management** tab in the **Settings** > **Workspace** section allows you to configure the data retention and governance settings for your workspace.

{{< info >}}
Only [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) can configure the data retention and governance settings in this tab.
{{< /info >}}

## Data definitions

RudderStack **does not** permanently store any customer data except the following:

- Aggregate "Count" data on Event Name, Event Type, Source ID, Destination ID
- Error codes
- RudderStack customers' records (usernames, billing-related details, etc.)

All other customer data can be classified as either **transient** or **non-transient** and it may either be stored in your location, for example, AWS, or by RudderStack on a rolling 7-day or 30-day basis depending on your plan and retention settings.

{{< info >}}
RudderStack's data retention policy defines data as they pertain to the primary components of its service — the [Data Plane]({{< ref "get-started/introduction/glossary.md#data-plane" >}}) and [Control Plane]({{< ref "get-started/introduction/glossary.md#control-plane" >}}).
{{< /info >}}

### Transient customer data

Transient customer data can be defined as all in-transit data, that is, **stored for less than 3 hours**, as an essential part of delivering the RudderStack product experience. This data includes:

- **Data Plane**: Events that hit the RudderStack gateway. See [Data Plane architecture]({{< ref "get-started/rudderstack-open-source/rudderstack-architecture.md#data-plane-architecture" >}}) for more details.
- **Control Plane**: The in-transit data captured in the [Live Events]({{< ref "monitor/live-events.md" >}}) tab of the RudderStack dashboard.

{{< customreadfile "/includes/live-events-regional-residency.md" >}}

### Non-transient customer data

Non-transient customer data can be defined as data that can persist for more than 3 hours **only if** configured by the RudderStack user. This includes:

- **Data Plane**: This includes **gateway dumps**, that is, raw data for every successfully-ingested event.
- **Control Plane**: Data in the reporting service ([sample events and responses](#sample-event-data)).

## Event data retention options

{{< info >}}
Event data retention options are available in the [Growth](https://www.rudderstack.com/pricing/) and [Enterprise](https://rudderstack.com/enterprise-quote/) plans. **Free** plan users only see the [Sample event data](#sample-event-data) retention option.
{{< /info >}}

To choose how you want to store event data, follow these steps:

1. Log in to your [RudderStack dashboard](https://app.rudderstack.com/).
2. Go to **Settings** > **Workspace** > **Data Management**.
3. Choose one of the data storage options in the **Data retention** section:

{{< image src="images/dashboard-guides/data-retention-options.webp" alt="Choose your data storage option." >}}

### 1. Do not store event data

If you choose this option, RudderStack will not store any of your event data.

### 2. Store event data in your own cloud storage (Recommended)

{{< tip >}}
Select this option to use the [Event Replay]({{< ref "user-guides/administrators-guide/event-replay.md" >}}) functionality.
{{< /tip >}}

Selecting this option brings up a modal allowing you to connect a storage bucket with your RudderStack data.

{{< image src="images/dashboard-guides/connect-cloud-storage.webp" alt="Store your data with your cloud provider." >}}

{{< info >}}
RudderStack supports storage via AWS, GCS, Azure, and MinIO if you select this option.
{{< /info >}}

When connecting your cloud storage provider to RudderStack, you will first need to create a storage bucket and configure the credentials for RudderStack to access the datastore. Follow the steps listed below depending on your cloud provider:

{{< tabs tabTotal="4" >}}
{{% tab tabName="Amazon S3" %}}

1. Create your [S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html).
2. In the dashboard, specify the **S3 Bucket Name** and **Prefix**.
3. **Role Based Authentication** is turned on by default. [Create a RudderStack IAM role]({{< ref "destinations/aws-iam-role-for-rudderstack/_index.md" >}}) and specify the **IAM Role ARN**.

If you have disabled **Role Based Authentication** (not recommended), configure the [permissions for your S3 bucket]({{< ref "user-guides/administrators-guide/bucket-configuration-settings.md#permissions-for-amazon-s3" >}}). Then, enter the **Access key ID** and **Secret Access Key**.

4. Enable server-side encryption, if needed.

{{< figure src="images/dashboard-guides/s3-data-retention-settings.webp" alt="S3 bucket settings for data retention" >}}

**If you are self-hosting RudderStack using RudderStack Open Source**:

1. Create your [S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html).
2. Configure relevant [permissions for your S3 bucket]({{< ref "user-guides/administrators-guide/bucket-configuration-settings.md#permissions-for-amazon-s3" >}}). Note the **Access key ID** and **Secret Access Key**.
3. Configure the bucket settings in the dashboard.

{{% /tab %}}
{{% tab tabName="Google Cloud Storage" %}}

1. Create your [object storage bucket](https://cloud.google.com/storage/docs/creating-buckets).
2. Configure the relevant [permissions for your bucket]({{< ref "user-guides/administrators-guide/bucket-configuration-settings.md#permissions-for-gcs" >}}).
3. Connect your storage provider in the RudderStack dashboard.

{{% /tab %}}
{{% tab tabName="Azure Blob Storage" %}}

1. Login to the [Azure portal](https://portal.azure.com/) and create a [storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal).
2. Click **Containers** under **Blob service** and create a new container.
3. Connect your storage provider in the RudderStack dashboard.

{{% /tab %}}
{{% tab tabName="MinIO" %}}

1. Login to your MinIO service and [set up your bucket]({{< ref "destinations/streaming-destinations/minio.md#setting-up-minio" >}}).
2. Connect your storage provider in the RudderStack dashboard.

{{% /tab %}}
{{< /tabs >}}

### 3. RudderStack 30-day cloud storage

{{< info >}}
This option is available only in the [Enterprise](https://rudderstack.com/enterprise-quote/) plan.
{{< /info >}}

Choosing this option allows RudderStack to store and delete your event data on a rolling 30-day basis.

### 4. RudderStack 7-day cloud storage (Default)

By default, RudderStack stores event data on a rolling 7-day basis in RudderStack cloud storage. This prevents data loss if a rare incident occurs.

## Sample event data

When the **Sample event data** setting is enabled, RudderStack stores and deletes sample events and responses on a rolling 30-day basis. This data may be helpful for debugging your events.

{{< info >}}
RudderStack **does not** consider the event name or event type to be Personally Identifiable Information (PII).
{{< /info >}}

{{< image src="images/dashboard-guides/sample-event-data.webp" alt="Opt in to sample event data storage." >}}

## Plan-based retention options

Based on your plan, RudderStack provides different options for event storage:

- **Sample events and responses**: Available on all plans. RudderStack stores and deletes sample events and responses on a rolling 30-day basis. On the **Free** plan, this is the only retention-related setting.
- **Event data**: Available on **Growth** and **Enterprise** plans. This includes events sent to RudderStack, including gateway dumps.

See the below table for the storage options supported by different RudderStack plans:

| Data type | Free | Growth | Enterprise |
| :----- | :-------| :--------| :--------|
| Sample event data | <i class="fa-solid fa-circle-check fa-xl" style="color: #2F965D;"></i> | <i class="fa-solid fa-circle-check fa-xl" style="color: #2F965D;"></i> | <i class="fa-solid fa-circle-check fa-xl" style="color: #2F965D;"></i> |
| Event data | <i class="fa-solid fa-circle-xmark fa-xl" style="color: #2E2E2E;"></i> | <ul><li>No data storage</li><li>Connect your own cloud storage</li><li>RudderStack 7-day storage (default)</li></ul> | <ul><li>No data storage</li><li>Connect your own cloud storage</li><li>RudderStack 7-day storage (default)</li><li>RudderStack 30-day storage</li></ul> |

## Data governance

Scroll down to the **Data governance** section and toggle on the **Event audit API** setting. This setting lets you toggle on/off the [Event Audit API]({{< ref "api/event-audit-api/" >}}). Use this API to monitor and act on any non-compliant data coming into your RudderStack sources based on predefined rules.

{{< image src="images/api/event-audit-api-dashboard.webp" alt="Event Audit API setting in RudderStack dashboard" >}}

## Limit PII access {#limiting-access-to-pii-related-features}

See the following sections for information on limiting access to PII-related features depending on whether you are using the [legacy Permissions Management (RBAC) system]({{< ref "archive/dashboard-guides/user-management.md" >}}) or the new [Access Management]({{< ref "access-management/overview.md" >}}) system:

- **Legacy Permissions Management (RBAC)**: See [Permissions Management]({{< ref "archive/dashboard-guides/permissions-management.md" >}})
- **Access Management (PBAC)**: See [PII Permissions]({{< ref "access-management/policies-overview.md#pii-permissions" >}})