Controlling data storage

This guide covers the various features available after data reaches PostHog Cloud servers to help you achieve your privacy goals. If you have data that cannot reach a third-party server like PostHog, please omit them during data collection.

This guide covers the following features:

Data storage location

If you require GDPR compliance, there are specific guidelines on the location of data storage if you collect personal data. If you require robust GDPR compliance, we recommend using PostHog Cloud EU – a managed version of PostHog that's hosted on servers based in Frankfurt.

Processing data before storage

PostHog supports realtime transformations of data before it's stored in PostHog. These transformations are applied to all events captured in realtime, so you can use them to:

• Redacting PII data before it's stored in PostHog
• Disabling default GeoIP enrichment transformations
• Dropping events based on a filter
• Hashing PII data
• IP anonymization

When in doubt, you can always create your own custom transformation. Custom transformations use the Hog language to transform data.

Data deletion

You can remove unwanted data from PostHog by deleting groups and persons.

Right to be forgotten

Persons and events can be deleted using our API endpoints. This action requires a personal API key.

To query all persons in your project, use the GET Persons API endpoint. You can filter for specific subsets of persons using the query parameters. For example, you can get a specific person by filtering by email:

export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    https://us.posthog.com/api/projects/:project_id/persons?email={EMAIL}

To delete the persons and their events, you can use the DELETE Persons API endpoint

To do that, iterate through the persons returned in the previous step and use the person's id in the DELETE call. To delete the person's corresponding events in addition to the person, add the delete_events=true parameter. For example:

curl -X DELETE "https://posthog.example.com/api/projects/{YOUR_PROJECT_ID}/persons/{ID}?delete_events=true" \
     -H "Authorization: Bearer {YOUR_API_KEY}"

Manual data deletion

You can manually delete persons and their events in the PostHog UI:

• Select Persons from the left-hand menu
• Search for the person via their distinct_id or a property like email.
• Click view next to the person within the search results
• Click Delete person to remove them and all their associated data from the PostHog instance. You will be prompted to confirm this action.

Asynchronous data deletion

While most data in PostHog is deleted instantly, event data is not. Instead data is cleared asynchronously during non-peak usage times (weekends on PostHog Cloud).

This is done because data deletion in ClickHouse is expensive and it can impact performance for other users.

Data access control

An important part of protecting your users' privacy is to control who can access what data in PostHog. PostHog provides access control at 3 levels:

1. Organization level
2. Project level
3. Resource level

It's up to you to use these access control features to grant access to only the people who need to access the data.

You can follow this comprehensive guide to access control to learn more.