diff --git a/lib/services/phishing-detector.ts b/lib/services/phishing-detector.ts
index 54349b5..a2e6ef4 100644
--- a/lib/services/phishing-detector.ts
+++ b/lib/services/phishing-detector.ts
@@ -127,6 +127,7 @@ export async function gatherTicketEvidence(
     `SELECT id, title, description, note_type, creator_resource_id, created_at
        FROM ticket_notes
       WHERE ticket_id = $1
+        AND is_deleted = false
       ORDER BY created_at`,
     [ticket.id]
   );
@@ -135,6 +136,7 @@ export async function gatherTicketEvidence(
     `SELECT id, resource_id, entry_date, hours_worked, start_date_time, end_date_time
        FROM time_entries
       WHERE ticket_id = $1
+        AND is_deleted = false
       ORDER BY entry_date`,
     [ticket.id]
   );