Retention depends on the record, Cord’s role, and the duties of the business or provider involved. The Privacy Policy describes the current state and expressly identifies schedules that still need record-by-record documentation.

Who keeps what, and for how long

• Tax documents (XML/PDF): Mexico’s Código Fiscal de la Federación (Article 30) imposes the taxpayer’s own retention duties. Cord keeps CFDI inside the organization while it exists, but it does not replace the business’s tax archive. Deleting the organization also deletes its documents from Cord’s primary database; export them first.
• Audit and contract evidence: selected security events and pseudonymous legal-acceptance evidence may remain outside the operational organization row to investigate incidents or establish the contract. The repository does not yet publish one approved period for that entire set, so this article does not invent one.
• Card data: Cord does not store CVV, magnetic-stripe track, or a tokenized PAN in its database. Stripe collects and tokenizes card details on its own surface and may retain records under its own financial duties. A request about those records must follow the role and procedure applicable to Stripe; deleting a Cord organization does not automatically erase them.

If you delete your organization, Cord deletes its primary row and dependent operational records, including tax documents stored in that organization. It does not automatically erase backups still in rotation, pseudonymous contract evidence, records a provider retains under its own duties, or data sent to an integration under Customer instruction. Export your CFDI first from Settings › Data & privacy.