Ellipsis deletes data within 4 hours after its time to live (TTL) expires.

## Data retention

| Data | Retention limit |
| --- | --- |
| Session data | Customer-configured TTL from 0 hours to 1 year |
| Other retained operational data, including webhook payloads | Maximum TTL of 3 days |

For example, data that expires at 12:00 UTC is deleted by 16:00 UTC. A TTL of 0 hours means data is deleted within 4 hours. Export records you need before their TTL expires.

## GitHub access

[Choose which repositories the GitHub App can access](/docs/integrations/github#repository-access), then [limit each session's GitHub permissions](/docs/permissions).

## Secrets

Store credentials as [secrets](/docs/secrets); stored values can't be read back through the dashboard or API. See [Permissions](/docs/permissions#secrets) for what a session can do with them.

## API access and webhooks

Keep [API keys](/docs/api/authentication) on your server. [Verify webhook signatures](/docs/webhooks#verify-signatures) before trusting a delivery.

## Contact

For security questions or deletion requests, contact [Support](/docs/support). Don't include secret values.