It's your data. Here's exactly what we do with it.
Seven years live and queryable, an export you can take whenever you want, and a plain answer to the question every auditor eventually asks.
Seven years, live
Not archived, not "retrievable on request" — live and queryable in the system you use every day. Pull a report from four seasons ago the same way you pull last week's.
Export whenever you like
One archive: a CSV for every table plus the original uploaded files. Not a courtesy we extend when you leave — a button you can press on a Tuesday for no reason at all.
Nothing vanishes quietly
Anything approaching the end of its window is flagged well before it gets there, with an export offered first. You should never learn about a retention policy by discovering something missing.
One number instead of a table of exceptions
We could keep employment records for one window, payroll for another and time cards for a third. Plenty of systems do. Then somebody has to remember which is which at exactly the wrong moment.
So everything gets the same window, chosen to clear the ones that matter with room to spare:
| Records | Commonly required | We keep |
|---|---|---|
| Employment tax records | 4 years | 7 years |
| Payroll records | 3 years | 7 years |
| Time cards | 2 years | 7 years |
| Employment eligibility forms | 3 years from hire | 7 years |
| Income tax records | 3 years from filing | 7 years |
This is the retention we commit to, not legal advice — your state or your accountant may want longer, and the window can be extended on your account if so. The clock runs from when a record is created rather than from when someone leaves, which is simpler and, for anyone with tenure, keeps things longer.
What we back up, and how often
Two things need protecting and only one of them is a database. Your operating records are one; the files — signed waivers, employee photos, completed forms, customer documents — are the other, and they're the ones a careless backup misses.
Nightly, both halves
The database and the uploaded files, taken together overnight so a restore gives you a consistent picture rather than records pointing at documents that aren't there.
A year of restore points
Daily backups for the last week, weekly for the last month, monthly for the last year — so recovery isn't limited to "whatever last night looked like".
Encrypted before it leaves
Waivers and employee records are in there. Backups are encrypted on the machine that makes them, and the key isn't stored with them.
Restores are tested, not assumed
Backups are restored on a schedule and checked against the live system. A backup nobody has ever restored is a hypothesis, and the usual way this fails is silently, for months.
What about the gateway on your mountain?
The edge gateway isn't backed up, on purpose. It holds a working copy plus anything queued during an outage, and both come back from the cloud the moment it reconnects. A failed gateway gets swapped and refilled — a fifteen-minute job, not a restore.
No hostage-taking
Close your account and you get the full export and ninety days to collect it. No fee, no ticket, no negotiation.
Software that makes leaving expensive is telling you what it thinks of its own product. We'd rather you stayed because the system works on a powder Saturday.
- Card numbers are never stored — not in the cloud, not on the gateway, not on a register.
- Each resort's data is isolated at the record level, not merely filtered in the interface.
- Your public site and store run on your own domain, so your guest relationships stay yours.
- We don't sell, share or aggregate your guest data. There is no other product here for it to feed.
Ask us the awkward version of any of this.
Where it's stored, who can reach it, what happens when a disk dies. It's a fair question and it has a specific answer.
Book a demo