Portfolio Proof
Venue Authority validates the CSV in memory and does not persist the file, complete normalized rows, submitted merchant names, or submitted street addresses. The report stores aggregates and up to ten regulator-only examples.
Venue Authority trust center
Data flow and retention
Portfolio Proof minimizes submitted merchant data and keeps billing truth separate from behavioral data.
Retention
Regulator-only examples expire after 30 days. Aggregate evaluations and authenticated acquisition events expire after 180 days. Failed Checkout attempts expire after 90 days, while purchase and credit truth follow their separate billing retention contract.
Anti-repeat controls
After an erasure request, Venue Authority can retain only versioned HMAC subject digests needed to prevent another complimentary grant. The tombstone does not contain an email, name, Clerk profile, upload, IP address, or activity history.