Plans, retention & deletion

What each StackRadar plan’s history window keeps, what happens when you downgrade or cancel, and how to delete clusters, organizations, and all stored data.

What each plan includes

Every plan — including Free — scans every image you run. No tier caps the number of images or truncates your inventory: charging for completeness would give you a partial, therefore wrong, picture of your own cluster at exactly the moment the product has to prove it works. What the paid plans buy is more clusters, more seats, and a longer history window.

Plan	Price	Clusters	Team members	History window
Free	$0	1	1	30 days
Pro	$59/month	5	10	1 year
Business	$199/month	15	25	2 years

Upgrades and plan changes live in Organization Settings → Billing and require the admin or owner role. Need more than Business offers? Contact sales.

The history window is real retention

The history window is not a display filter. Data older than your plan's window is deleted on a scheduled sweep, not hidden behind a paywall — the window you see is the window that exists, and our privacy policy states it as a deletion schedule. Upgrading extends how far back your history will reach from now on; it can't resurrect what an earlier window already deleted.

What ages out — and what never does

Four kinds of data are history, and all four age out at the window:

Trend snapshots — the organization and per-cluster metrics behind the trend charts.
Scan-run history — the per-image record of past vulnerability scans.
The activity feed — remediation and issue events.
Saved SBOMs of images you no longer run — when nothing in the cluster references an image anymore, its SBOM stays retrievable for the plan window (never less than 30 days), then is collected. A paused cluster or a seasonal workload comes back to its SBOM intact.

The current picture never ages out, on any plan. A running image's SBOM and findings are the live inventory, not a timeline — an age check on them would hide a still-deployed image from exactly the "are we affected?" question the product exists to answer. As long as an image is deployed, its SBOM is visible.

Downgrading and cancelling

Downgrading shrinks the window: history older than the new plan's window is deleted by the next retention sweep and can't be recovered. The same applies when a cancellation lands you on Free — anything older than 30 days goes.

Cancelling is done through Manage Billing on the Billing tab, which opens the Stripe billing portal. Your paid plan stays active until the end of the period you already paid for — the Billing tab shows the date — and then the organization moves to Free.

A downgrade can leave you over the new plan's limits, and that is warned, not enforced: nothing is taken away. Existing clusters keep reporting, existing members keep their access, and the dashboard shows a warning on the Billing tab. What you can't do while over the limits is add new clusters or members — until you're back under them, or upgrade.

Deleting a cluster

From the cluster's Settings tab, the Danger zone section has Delete cluster — type the cluster's name to confirm. Deletion removes:

the cluster's inventory — namespaces, workloads, and containers,
every image the cluster reported, with its SBOM, components, and findings — images are cluster-scoped, so this is complete and touches no other cluster,
the cluster's scanner API key, which is revoked immediately.

This cannot be undone. Uninstall the scanner from the cluster as well — otherwise it keeps retrying against a revoked key:

bash

helm uninstall stackradar-scanner --namespace stackradar

Deleting your organization

Only the owner can delete an organization. Deletion first cancels the Stripe subscription — you will not be charged again — and then removes the organization and everything in it: all clusters, workloads, SBOMs, API keys, members, and history. There is no undo. Organization deletion is not yet self-serve in the dashboard: email contact@stackradar.io from the owner account and we'll remove it.

Revoking access without deleting data

Deleting removes the record; revoking a key only stops the reporting. To decommission a cluster while keeping what it reported, revoke or rotate its API key from the cluster's Settings tab (or Organization Settings → API Keys) — the scanner fails authentication immediately, and everything already uploaded stays. See API keys & cluster scoping for the mechanics, and the quick start for reconnecting later.

When someone with access to a cluster's API key leaves your team, rotate the key. Removing them from the organization revokes their dashboard access, not the key in their shell history.

Where your data is stored

What the scanner sends, where it's processed and stored, and how it's protected are covered on the security page.

Next steps

Organizations & membersHow StackRadar organizations work: the roles and what each allows, inviting teammates by email, accepting an invite, and removing members.