Retention Policy

The system distinguishes between the following categories of data for retention purposes. Each category is subject to independent retention schedules as defined in the applicable engagement agreement:

• Governance Events. Append-only procedural records capturing every state transition, authorization decision, and system operation. Governance events are the authoritative procedural history and are typically subject to the longest retention periods.
• Sealed Artifacts. Frozen record manifests, closure certificates, and inclusion proofs that have been cryptographically sealed. Sealed artifacts are tamper-evident and are retained in their sealed form — they are not modified during the retention period.
• Submitted Materials. Materials submitted to the system during engagement operations, tracked by cryptographic hash. Retention of submitted materials may be governed by legal hold requirements, court orders, or regulatory mandates independent of the engagement agreement.
• Access and Session Logs. Authentication events, session records, and access denial logs. These records support security audit and incident response and are typically retained for shorter periods than governance events.
• Engagement Configuration. Role assignments, engagement parameters, authority records, and posture settings. Configuration data is retained for at least the duration of the engagement and any applicable post-engagement retention period.

Upon expiration of the applicable retention period, and absent any legal hold, regulatory requirement, or court order requiring continued retention, data is deleted in accordance with the deletion procedures specified in the applicable engagement agreement and data processing addendum.

Deletion is a recorded operation. The system logs the deletion event, the categories of data deleted, the applicable retention schedule, and the authorization for deletion. Deletion events are themselves retained in the governance event log as part of the permanent procedural record.