Data Governance

What data does Rockhopper store?

Understanding exactly what data Rockhopper holds is important for any security evaluation. Here's a clear breakdown:

Data Rockhopper stores

Data type	What it includes	Purpose
User profile	Name and email address (sourced from Microsoft or Google account)	Identify users, display names, enable @mentions
Team membership	Which users belong to which teams, and their roles	Access control and collaboration
File metadata	File names, drive/file IDs, enrollment timestamps	Track which files are managed by Rockhopper
Version snapshots	Point-in-time copies of enrolled spreadsheets	Enable version comparison and revert
Change records	Which cells changed, old/new values, who made the change, when	Change tracking and audit trail
Comments	Comment text, author, timestamps, version associations	Team collaboration
Review records	Review requests, reviewer assignments, approval status	Formal review workflow
Activity logs	Who did what and when (audit trail)	SOC 2 compliance and traceability

Data Rockhopper does NOT store

• User passwords or credentials — Authentication is fully delegated to Microsoft or Google

• Email, calendar, or contacts — Rockhopper only accesses files, not other Microsoft 365 or Google Workspace data

• Spreadsheet contents beyond change tracking — Rockhopper does not index, search, or analyze the contents of your files

Data retention

Data is maintained for the duration of the contractual agreement with your organization:

• Version snapshots are retained indefinitely (including discarded and reverted versions) to preserve the audit trail

• Comments and reviews are retained for the life of the file

• User accounts persist until the organization requests removal

At the end of a contract, all data associated with your organization is purged.

Data export

You can request a full export of your organization's data at any time. Contact [email protected] and we'll provide the export within one week.

Data deletion

Rockhopper can perform a complete purge of specified accounts or data upon request. Contact [email protected] to initiate. After an export is provided, all associated data is purged within 24 hours.

Personal data protection

Rockhopper collects only the personal information necessary for operation — names and email addresses from your identity provider. The platform does not collect or store personal data outside this scope.