Purging submissions

An owner or manager can Purge a form's submissions: delete them from the server for good, for example test submissions before fieldwork, or data past its retention date. It is on each form in Monitor (and as Purge data on Collect).

How a purge works

1. Choose what goes: submissions received before a date, or a list of KEYs.
2. Review the exact list of submissions that will be deleted.
3. Confirm by typing how many submissions will go. The count is checked again, under the form's lock, against what is on the server at that moment, so a submission arriving in between is never deleted unseen.
4. Joripo makes a zip backup of those submissions and their attachments and verifies it before deleting anything.
5. The files and their index rows are deleted together, and the purge is added to the form's purge log, with who did it and when. It is also recorded in the activity log.

Nothing outside that form is touched.

The backup

The backup zip is kept with the form on the server, sealed like the submissions when encryption at rest is on. It is there to recover from a mistake; ask the server's maintainer if you need one opened. To delete data so that it cannot be recovered at all, the backup has to be removed as well, by the maintainer.

Purge or reject?

To keep a submission out of your analysis without destroying it, reject it instead (Review and correct): exports leave out rejected submissions by default, and the decision can be reversed. Purge is for data that must not be kept.