Retention
Retention policies say how long the workspace keeps each kind of personal record. Every night, records older than their policy are deleted or anonymized.
Owners manage policies under Trust → Retention or Admin → Retention and barriers.
Defaults
| Record type | Default (days) | Minimum (days) | Action | Note |
|---|---|---|---|---|
| Notifications | 365 | 30 | Delete | |
| Audit trail | 2557 | 2557 | Delete | Seven years: the audit trail's minimum |
| Consent records | 1095 | 365 | Delete | Withdrawn records only, counted from the withdrawal |
| Data requests | 1095 | 365 | Delete | Completed and cancelled requests only, counted from when they closed |
| Access logs | 730 | 365 | Delete |
Other parts of the app add their record types as they arrive, each with its own default and minimum. The settings page lists every type that applies to your workspace, with a one-line description of each.
Changing a policy
For each record type, an owner can:
- set the days, at or above the minimum. The minimum is a legal or governance floor, so the page does not accept less, and a stored value below it is raised to it;
- choose the action where the record type supports more than one: delete the records, or anonymize them (every field that names a person is replaced with the text "erased:retention");
- reset to the default.
Every change is recorded in the audit log.
The nightly run
Every night at 03:17 UTC, a job applies every policy in every organization. Each run is listed under Recent runs, with its status (running, completed, failed) and how many records it deleted or anonymized per record type. For each record type it touched, a run adds one entry to the audit log, saved together with the deletions. A run that fails changes nothing and is listed as failed.