Skip to main content
Pilot Status lets you control how long sensitive data (PII) is stored. There are two independent layers:
  1. API-key-level retention — how long outbound message logs keep PII.
  2. Per-number PII mode — whether inbound/outbound chat messages and conversations are stored at all.

​
API-key-level retention

Configured per API key on the API Keys page (/api-keys):
  • retentionDays > 0 — PII in outbound message logs is kept for up to N days.
  • retentionDays = 0 — PII is not persisted.
Even with retention off, webhook events are still delivered — sensitive fields (e.g. destinationNumber, content) may be empty, but IDs, timestamps, status, and tracking metadata remain.

​
Per-number PII mode

Each WhatsApp number is configured independently with one of three modes (set on the number’s settings in the dashboard):

​
Effect on the dashboard

​
Effect on v1 read endpoints

GET /v1/conversations, GET /v1/messages/unread, and GET /v1/messages/group apply the same gate:

​
Flow data

A WhatsApp Flow keeps three records of its own, and their windows are fixed by the platform — they are not the API key’s retentionDays, and not the number’s piiRetentionDays.
Why the exchanges get one day more than the responses. An exchange is captured while the customer is still filling the form, minutes before the submission that creates the response row. On an identical 30 days the exchanges would expire first, and a response in its last minutes of life would publish an empty submitted beside answers that had been there the whole time.
On a RELAY_ONLY number no exchange is stored at all — not a blanked row: no row. The call is still decrypted and forwarded to your endpoint, as everything is in that mode; what is not kept is the copy. Where a number’s redaction blanks a stored copy of the event, submitted comes back null — never [], which would read as answers hidden rather than answers absent. On the read surface, GET /v1/flows/{id}/responses, empty is spelled [] instead: there is no stored payload to redact there, and a field set to nothing would vanish from the JSON rather than arrive empty.
The re-hosted Flow file outlives the response it belonged to, at a public URL. Whoever holds the link reads it, and the link keeps working after the answers have stopped being served at GET /v1/flows/{id}/responses. Decide that before a Flow of yours asks somebody for an identity document.

​
Forwarding is always active

Regardless of PII mode, these always work:
  • Outbound webhooks (delivery events and inbound events)
  • The Chatwoot integration (receiving and replying)
  • Sending messages
Only storage and read-back are affected.