If you import a data file into workbench for querying or attempting to load into Salesforce, is it stored anywhere outside of Salesforce that may need to be purged?
The workbench is written in PHP. As such, uploads and downloads will be temporarily stored in various files stored on the workbench server. These files will be automatically purged periodically, and, as far as I can tell, can't be leaked across sessions.
Technically, this may violate some IT or legal policies regarding data retention, even though this data will never be accessible to another user, authenticated or not, and will not be permanently retained anywhere outside of Salesforce. If that applies to your situation, you can always clone the forceworkbench repo and host your own copy that complies with whatever regulations or policies you need to.