Last week we did something to our own systems that most organizations never do to any of theirs: we investigated what our form provider actually does with data when we delete it.
The Starkeepers collect assessment answers through Tally, a form service we like and chose deliberately. We still asked the questions. Here is what we found: deleting a submission does not delete it — it moves to a trash folder that holds it for ninety days unless someone empties the trash on purpose. There is a setting that auto-deletes data on a schedule — and it is reserved for a paid tier. And like nearly every online service, their internal backups age out on their timetable, not ours — a residue no customer can verify is gone.
None of that makes Tally a bad service. It makes Tally a normal one. The point is that we did not know any of it until we asked — and your organization is probably trusting several services you have never asked.
The five questions
Ask these about any system that holds something your organization cannot lose — especially the free ones. The answers usually take one afternoon to find, and they belong on one page in a drawer someone can find.
- What does “delete” actually mean? Trash folders, soft deletes, and recovery windows are the norm. Find out how long deleted data lingers and whether you can force it out sooner.
- Where does your data live, and who can see it? Which company, which country, and which of their staff or partners have access. The answer is in their privacy policy, which nobody reads — read yours.
- What do their backups keep after you leave? Almost every service keeps backups that outlive your deletion, and almost none will tell you exactly how long. You cannot eliminate this residue. You can know about it, minimize what ever rests there, and say so honestly to the people whose information it is.
- Can you export everything, today? Try it — actually run the export. The day you need it is the wrong day to learn it only exports half your fields, or that export is a paid feature.
- What is “free” costing you? Free that sells features is honest; free that sells data is not. Read what the company says it does with your information to make the free tier possible. If the answer is vague, the answer is you. And notice which features sit behind the paid tier: in our case, the automatic-deletion schedule — exactly the kind of protection a careful organization would assume is included. Free is real; it is simply not free with the protections you may expect.
What we did with our own answers
We changed how our assessment pipeline works: answers now transfer to systems under our own control the moment they are submitted, and the pipeline itself deletes the copy at the form provider automatically, the instant that transfer succeeds. We would have turned on the provider’s auto-delete setting as a backstop too — it turned out to require a paid plan, so we built the protection ourselves rather than pay for the assumption. And the backup residue we cannot verify is stated plainly on our stewardship page — because the organizations we serve deserve the truth about the ten percent no one can fix, not just the ninety percent we could.
The takeaway
Pick the three systems your organization would suffer most to lose — the donor list, the archive storage, the email account. Ask the five questions of each. Write the answers on one page, date it, and revisit it once a year.
And if your organization has no one whose job it is to ask questions like these — that is exactly the gap The Starkeepers exist to fill. The health check is free, and it asks these questions with you.
— Todd