76 lines
12 KiB
Markdown
76 lines
12 KiB
Markdown
# Data Retention Defaults
|
|
|
|
## Scope
|
|
|
|
This document defines repository-level default retention classes for privacy- and data-protection-relevant surfaces in this boilerplate. It is an operational engineering schedule for future implementation work, not legal advice and not a statement that retention automation already exists. Product owners must confirm jurisdiction-specific requirements before enabling deletion jobs, provider cleanup, exports, or audit evidence workflows.
|
|
|
|
The defaults apply to application data, operational evidence, generated artifacts, and optional plugin-candidate surfaces unless a narrower product policy is approved. Examples in this document are intentionally placeholder-shaped, such as `<surface-label>`, `<request-id>`, `<job-id>`, and `<count>`. Do not replace them with real customer identifiers, email addresses, tenant slugs, domains, object keys, signed URLs, API keys, provider message identifiers, or exported data samples.
|
|
|
|
## Default retention classes
|
|
|
|
| Class | Default handling | Evidence allowed |
|
|
| --- | --- | --- |
|
|
| Account lifecycle | Retain while the account or required security relationship is active; queue erasure or minimization after closure once required audit/accounting holds are resolved. | `<surface-label>`, closure status, redacted request ID, affected row count. |
|
|
| Tenant lifecycle | Retain while the tenant is active; after tenant closure, delete tenant-owned content and minimize retained operational references. | Tenant surface label, deletion job status, counts, redacted diagnostic code. |
|
|
| Short-lived operational artifact | Expire temporary uploads, import sources, export files, retry payloads, and generated reports as soon as the workflow no longer needs them. | Artifact class label, expiration status, job ID, count. |
|
|
| Operational telemetry | Keep logs, metrics, webhook attempts, API access logs, queue state, and notification delivery state only for troubleshooting, abuse prevention, reliability, and security windows. | Route class, endpoint label, status, duration bucket, request ID, queue name. |
|
|
| Security and audit evidence | Restrict and minimize audit, impersonation, fraud, and security records; retain only the fields needed to reconstruct security events. | Audit surface label, actor/target relationship state, status, redacted event code. |
|
|
| Provider/accounting exception | Retain minimal external-provider, billing, tax, chargeback, and legal-hold references when deletion is not allowed by an approved business or legal requirement. | Provider category, local reference status, accounting status, redacted support code. |
|
|
| Plugin-candidate review | Treat optional plugin and app-engine data as potentially personal until classified; do not export, migrate, or delete with broad defaults before review. | Candidate surface label, classification status, owner, review date label. |
|
|
|
|
## Surface-by-surface defaults
|
|
|
|
| Surface | Default class | Default retention behavior | Implementation follow-up |
|
|
| --- | --- | --- | --- |
|
|
| Account users | Account lifecycle | Keep identity, profile, credential metadata, MFA state, and membership links while the account is active; after closure, delete or minimize direct personal fields while preserving only approved audit/accounting references. | Add account closure workflow, credential invalidation, MFA secret cleanup, and redacted erasure evidence. |
|
|
| Tenants and organization profile | Tenant lifecycle | Keep tenant profile and membership state while the tenant is active; after tenant closure, delete tenant-owned content and minimize organization identifiers in retained evidence. | Add tenant closure job, tenant-owned cascade review, and object/provider cleanup checks. |
|
|
| Invitations | Short-lived operational artifact | Expire pending invitations after a short configured window; delete accepted, revoked, or expired invite records when they no longer support abuse prevention or audit review. | Add invitation expiry/deletion job and safe invite-status diagnostics. |
|
|
| Registration records | Short-lived operational artifact | Remove incomplete registration records after the signup window closes; retain only redacted abuse-prevention evidence when approved. | Add registration cleanup job and duplicate-signup evidence minimization. |
|
|
| API keys | Account lifecycle | Keep key metadata while keys are active; delete revoked/expired key material and retain only minimal non-secret audit references. | Verify key hash/prefix/last-four redaction and key revocation cleanup. |
|
|
| API logs | Operational telemetry | Keep access telemetry for a bounded troubleshooting/security window; aggregate or delete endpoint params, IP references, and user/tenant links when no longer needed. | Define log TTL, param scrubbing, IP minimization, and diagnostic aggregation. |
|
|
| Entity rows, values, tasks, relationships, and permissions | Tenant lifecycle | Treat tenant-defined entity data as arbitrary personal data; soft-delete only for a limited restoration window, then hard-delete rows and child data. | Add hard-delete job, child-table erasure verification, and restore-window controls. |
|
|
| Entity comments | Tenant lifecycle | Mark comments deleted for user-facing removal, then hard-delete content after the restoration/audit window. | Ensure `isDeleted` records do not retain visible personal content indefinitely. |
|
|
| Files and uploads | Short-lived operational artifact | Delete upload progress, chunks, derived media, object metadata, and object-store blobs when no active row, email, import, export, or audit exception needs them. | Add object-store deletion hooks, checksum-safe evidence, and orphan cleanup. |
|
|
| Imports | Short-lived operational artifact | Expire source files, parsing state, rejected-row reports, and import error artifacts after review or retry windows close. | Add import artifact TTL, error-report deletion, and redacted failure summaries. |
|
|
| Exports | Short-lived operational artifact | Treat export files as sensitive generated artifacts; expire and delete them promptly after download or request completion. | Add export artifact expiration, object-store deletion verification, and data-subject scope controls. |
|
|
| Email and campaigns | Operational telemetry | Retain message bodies, recipients, sender state, campaign events, opens, clicks, and attachments only for delivery, consent, abuse, or product-support windows; minimize tracking data afterward. | Define provider deletion, unsubscribe/bounce preservation, body redaction, and campaign-event TTL. |
|
|
| Notifications | Operational telemetry | Keep notification preferences while active; retain delivery attempts and payload metadata only for delivery/retry and support windows, then aggregate or delete. | Add payload metadata scrubbing and provider-message deletion evidence. |
|
|
| Webhooks | Operational telemetry | Keep webhook attempt metadata and response status for retry/debug windows; remove raw payloads, signatures, and provider details from durable evidence. | Add webhook attempt TTL, payload redaction, and dead-letter cleanup. |
|
|
| Queues and background jobs | Short-lived operational artifact | Keep queued, retry, and dead-letter payloads only while required for workflow completion or troubleshooting; purge stale payloads and redact evidence. | Add queue TTLs, poison-message review, and safe job failure summaries. |
|
|
| Metrics, analytics, IP, and geodata | Operational telemetry | Prefer aggregation, truncation, or deletion once troubleshooting/security windows close; avoid retaining precise IP or geolocation values in shared evidence. | Add IP minimization, metric aggregation, analytics retention, and access review. |
|
|
| Billing and subscriptions | Provider/accounting exception | Retain minimal billing identifiers, usage records, credits, and checkout state only for accounting, chargeback, tax, entitlement, or provider reconciliation requirements. | Define approved accounting retention, provider deletion limits, and local identifier minimization. |
|
|
| Audit, impersonation, and security events | Security and audit evidence | Keep restricted audit trails needed for security investigation and accountability; minimize actor/target personal fields and apply access controls. | Add audit retention basis, impersonation review, access logging, and redacted export behavior. |
|
|
| Plugin-candidate surfaces | Plugin-candidate review | Treat knowledge-base, workflow, app-engine, form, portal, site, prompt/AI, help-desk, analytics, feature-flag, onboarding, and similar candidate data as personal until classified. | Require per-candidate classification before migration, export, deletion, pause/resume, or provider sync work. |
|
|
|
|
## Erasure and deletion handling
|
|
|
|
- Deletion workflows must distinguish active product records, soft-deleted records, generated artifacts, provider-held data, and restricted audit/accounting exceptions.
|
|
- User erasure must cover direct user records plus memberships, invitations, registrations, credentials, API keys, notifications, email reads, created entity data, comments, tasks, files, metrics, impersonation references, and plugin-candidate ownership where applicable.
|
|
- Tenant erasure must cover tenant profile, memberships, API keys/logs, entity data, imports, exports, files, email/campaign data, notifications, webhooks, queues, billing references, plugin-candidate data, and object-store artifacts.
|
|
- Object-store and provider deletion must be implemented explicitly; database cascades alone are not evidence that blobs, provider messages, queue payloads, analytics records, or billing-provider records were removed.
|
|
- Security, fraud, accounting, chargeback, and legal-hold exceptions must retain the minimum fields needed and must not hide unresolved deletion work.
|
|
- Erasure evidence must use placeholder-shaped operational facts only: `<request-id>`, `<job-id>`, `<surface-label>`, `<count>`, `<status>`, and `<redacted-code>`.
|
|
|
|
## Operational evidence
|
|
|
|
Safe evidence includes surface labels, model labels, route or endpoint labels, command names, exit codes, request IDs, job IDs, queue names, counts, status labels, duration buckets, and redacted diagnostic codes.
|
|
|
|
Unsafe evidence includes secrets, bearer tokens, cookies, API keys, key hashes, key prefixes, key suffixes, authorization headers, customer names, tenant identifiers, customer domains, email addresses, phone numbers, precise IP addresses, object keys, signed URLs, webhook signatures, provider payloads, queue payloads, raw logs, screenshots containing personal data, import/export contents, and message bodies.
|
|
|
|
Retention diagnostics should report omissions, missing headings, unsupported placeholders, and checked-file observations without connecting to providers, browsers, production systems, Docker, registries, or E2E environments.
|
|
|
|
## Manual approval boundaries
|
|
|
|
- This document does not authorize production deletion jobs, provider-console actions, billing-provider deletion, legal holds, customer notices, or data-subject response decisions.
|
|
- Runtime checks against browsers, provider consoles, object stores, queues, production traffic, Docker, registry services, Playwright, or Cypress remain manual unless a human explicitly approves the exact check in the current session.
|
|
- Changes that alter retention periods, legal bases, accounting exceptions, or customer-facing promises require product/legal review outside this repository task.
|
|
- Implementation work must preserve unresolved gaps rather than implying that object-store deletion, provider deletion, export expiration, or queue cleanup already exists.
|
|
|
|
## Implementation follow-ups
|
|
|
|
1. Extend the data-protection documentation verifier to require this document, required headings, required surface coverage, and absence of placeholder markers.
|
|
2. Add account, tenant, invitation, registration, entity, import, export, file, email, notification, webhook, queue, metrics/IP, billing, audit, and plugin-candidate retention jobs or explicit non-automation decisions.
|
|
3. Add object-store deletion hooks and provider deletion/minimization evidence for files, imports, exports, email, notifications, webhooks, analytics, and billing where supported.
|
|
4. Add data-subject export and erasure workflows that use redacted evidence and separate deletable data from approved audit/accounting exceptions.
|
|
5. Add tests that fail when required retention headings are missing, surface classes are omitted, or forbidden placeholder markers are introduced.
|