Workspace, data region and retention

The workspace facts you quote to support, the fleet switches, how long each class of data is kept, and how your data is isolated.

This page covers four sections of Settings: General, Fleet, Data & retention and Appearance. The retention table is platform-wide, not per workspace, and most of it is read-only.

​

General

Card	What it holds	Who can change it
Workspace	How this workspace is named and provisioned. Renaming a workspace or changing its plan is a support action: ask your Quint contact.	Support
Workspace ID	The identifier to quote in a support request. Click the value to select it.	Nobody
Data region	Where this workspace’s data lives. It is set when Quint places the workspace, and it does not move. Changing region is a support action.	Support
Danger zone	Transfer ownership to a named member, and Deletion request. Both ask you to type the workspace name before they arm.	Owner only

Ownership transfer is reversible by the new owner. A deletion request “is a recorded ask, not a countdown”: it opens a request with Quint, with an optional Reason, and Withdraw request cancels it. The Danger zone is not hidden: every role below Owner sees it with its controls disabled, under the note “Owner only”. Under a partner’s delegated session the two actions are not shown at all, because ownership and deletion changes are made by the customer.

​

Fleet

Setting	What it does	Who can change it
Enforcement mode	”Whether your organisation’s rules in the active policy pack block what they match, or only record it (shadow). Shadow is the default on purpose: arm a fleet only after the matches read as true positives.” The same switch is Policies › Enforcement.	Admin or Owner
Agent rollout	The sensor version endpoints are being moved to, and what share of the fleet is offered it. Set Target version and Share of fleet (%), then Save; Clear target empties it. Empty means every endpoint stays on what it has.	Admin or Owner
Require an install or enrollment token and Live install tokens, at most	Enrolment controls; see Install and enrollment tokens.	Admin or Owner

Read Shadow enforcement before changing Enforcement mode, and arm together with your Quint contact.

​

Data & retention

Retention lists how long each class of data is kept, including what has no automatic deletion yet. The values are platform-wide.

Data class	Kept for	In plain words
Sessions	365 days	Deleted 365 days after the session ends. A session outlives its events.
Events	14 to 45 days	Counted from the event’s own time. How long within that range depends on where in the month the event fell.
Divergence findings	14 days	Counted from the event’s own time.
Detections	14 or 90 days; some kept	An untriaged detection is deleted after 90 days. A resolved or false-positive one is deleted after 14 days. A detection marked under investigation is not deleted.
Events over 200 KiB	2,555 days	The body copy held in object storage expires 2,555 days after upload, and the expired version is removed 90 days later.
Longer-lived records	90 to 400 days	Machine commands, resolved posture findings, asset history and the MCP change ledger: 365 days. MCP scans, health samples and closed approval holds: 90 days. Suppression records: 400 days.
Sentinel conversations	14 days after last use	A conversation nobody returns to is deleted 14 days after its last use.
No automatic deletion yet	No window	Offboarding exports, incidents, alerts, the Sentinel tool log, daily briefs, divergence reports, hourly activity rollups, agent baselines, SDK sessions and events, detections under investigation, open posture findings, and the admin audit log. Inventory (machines, agents, MCP servers, connectors) is kept while the workspace exists. The dashboard notes that this is not a complete list.
Backups	7 days	Data deleted from the database stays in backups for up to 7 more days.

Two retention facts live on other pages. The Compliance page looks back 14 days at most. On Incidents, alert arrivals are kept 14 days.

​

Isolation

The Isolation card states what separates your data from another workspace’s. Every query is scoped to your workspace at the database level, and no request can name another workspace; the workspace always comes from the signed-in session.

​

Appearance

Appearance, under the you group in the Settings rail, is per member. Any role can change it.

Setting	Options	Note
Theme	System, Light, Dark	System follows the OS setting live. Also in the account menu, bottom-left.
Text size	Standard, Compact	Standard keeps nothing readable under 12px. Compact is the original dense scale, for maximum rows per screen.

​

Export before data ages out

Events, findings and resolved detections leave the hot store after 14 days or soon after. If you need them longer, export them before then.

• Audit Trail has Export and Export CSV for captured agent activity. Export downloads the whole log as a file and is itself recorded. See Compliance and audit.
• Compliance has Export CSV for detector fires mapped to framework controls.
• Divergence has Export CSV for findings. See Investigate a finding.
• A batch exporter sends every event, and the admin audit log, to a store you control as it happens. See Export events to your SIEM.

​

Next

• Members, invitations and sign-in
• Install and enrollment tokens
• Glossary, for the term Retention