It is important to destroy a session after you withdrawn all funds from it. We place a 25 days auto deletion timer on sessions, to protect users who may have forgot this step. Destroying a session wipes the session key off the server, making it as if the session was never created.
Do you have actual physical possession of your server in your data facility or is it hosted someplace else?
-Dave