What we hold, what we don't.

The minimum the calc engine needs.

Every field below is read by at least one calc rule. If a field doesn't feed a calc, it isn't on the list and doesn't live in the database.

• Display name. Operator-chosen — typically the client's name, but any firm-managed convention works (initials, reference, file number). The label exists so the paraplanner can find the right case; the calc engine never reads it.
• Date of birth. Age-precision matters — a few months either side of state-pension age changes available actions on the LSA, on the LSDBA and on protection regimes.
• Tax residency status, marital status. Drives the rUK / Scottish split and any spousal apportionment on the bond side.
• Protection status. Structured field — enhanced, primary, fixed (2012 / 2014 / 2016), individual (2014 / 2016). Affects LSA and LSDBA ceilings, never free-text.
• Pension arrangements + contribution and event histories. The DB and DC arrangements feeding the PIA test, plus the prior three years of inputs that drive carry-forward (PTM055100).
• Headline income figures by year. Threshold income, adjusted income, relevant UK earnings. Single numbers per year per category — not the granular payslip lines they were derived from.

Not required, and invisible to the calc engine.

None of the fields below feed any calc rule, so the engine never reads them and we never ask for them. Any identifying information a paraplanner does enter is encrypted at the application layer before storage; the calc engine never reads it.

• NINO. Not a calc input on either tool. HMRC's own pension and bond worked examples don't use one, so the engine never reads it. If your firm enters it in the client record it is encrypted at the application layer; we never require it.
• Address. We don't run postcode-by-postcode advice surfaces, so no calc rule reads an address. We recommend identifying clients via the case reference your firm picks; where an address is entered it is encrypted at the application layer and is never seen by the engine.
• Scheme member reference numbers. The PIA test uses opening and closing capital values (PTM053100) or contributions paid (PTM044100). Neither needs the scheme membership number, so it doesn't enter the case record.
• Employer details and payslip data. Income context comes in as the headline figures per tax-year category, not the granular salary lines or payroll IDs they were derived from. The P60 your paraplanner uploads is parsed for the three or four figures the calc needs and then deleted.
• Dependant identifying details. Where a calc references dependants (death-benefit allowance apportionment, for example), the input is a count plus structured tags, never named individuals.

Three buckets, three horizons.

Source documents. P60s, pension scheme statements, chargeable-event certificates and the other PDFs you upload for figure-extraction are stored in UK-region object storage, parsed by the extraction layer, and then permanently deleted 24 hours after they were created. An hourly cron is the enforcement point. Nothing carries over between paraplanner sessions.

Parsed extractions. The structured field data lifted from each document lives on in the case record. That's the audit artefact — a paraplanner returning to the file in eighteen months can see exactly which figures fed the calc and where each one was provenance-tagged from. Retention is six years from the calc date, aligned with FCA SYSC 9, and persists past subscription cancellation.

Output PDFs. The compliance annex you download is held for 30 days by default so you can re-fetch without re-running the calc. Firms on the Firm tier can extend retention; the underlying audit-trail row stays for the regulatory minimum either way and the PDF can always be re-rendered from it.

Source: app/api/cron/purge-extractions/route.ts · FCA SYSC 9

Frozen at calc time. Replayable years later.

Every calculation persists the full input set, the engine version (sourced from package.json at build time), the tax-year config version, the calc date, the inputs in pence-integer form, every intermediate step, and the result. Twelve months on, feeding those inputs into the engine at the recorded version produces a byte-identical output.

Signed results are immutable and replayable. More on replayability.

Self-serve, within UK GDPR Art. 17 limits.

Firm owners delete the firm and its client PII directly from Settings → Firm → Danger zone. Client PII is hard-deleted on submission. The calc-run audit trail is retained for six years (FCA SYSC 9) and survives erasure of the firm record — that residual is a regulatory obligation, not a product decision.

Subject-access (Art. 15) and portability (Art. 20) are available at Settings → Account → Export my data. We respond to any other request inside 30 days at info@paraplanai.co.uk. Privacy notice §7 has the full list of rights.