Retention and deletion
Status: Accepted · Version: 0.1
Times below are the product defaults for the first production version. Prototype data is synthetic and should be wiped when the demo environment is rebuilt. Do not keep demo databases that contain even synthetic instructions for longer than the exercise needs.
| Data | Keep | Delete |
|---|---|---|
| Vault ciphertext and data keys | Until owner deletes the vault or the account, unless a legal hold is recorded | On delete: destroy rows and data keys. Backups age out within 30 days |
| Drafts never activated | 90 days of inactivity, then delete | Same key destruction |
| Contact channels | While the contact is INVITED or ACCEPTED, or while a release token is live |
On reject, remove, or account deletion, remove from send lists immediately |
| Recipient access tokens | Until expiry (60 minutes for the entry link; 7 days for approved access) or revocation | Expired tokens are useless; store only a hash |
| Life-check attempts | 24 months | Keep channel and outcome, not message body beyond the template id |
| Audit events | 7 years, minimized | No instruction bodies. On account deletion, drop any field that is not required to explain who did what |
| AI prompts and drafts | Until the owner deletes them, and never used to train a shared model | Delete provider-side copies or do not enable the provider |
| Operational logs | 30 days | Must already be free of restricted data |
Legal hold
A recorded legal hold pauses deletion of the named records and must be audited. The prototype has no legal-hold implementation. Do not improvise one in a support inbox.
Global hold is not retention
release.disable=true stops delivery. It does not extend how long ciphertext is kept, and it does not delete it.