Data retention and legal hold
How technical retention, evidence preservation and legal obligations should be managed without assuming one retention period fits every data class.
How to interpret this document
This content describes technical and methodological behavior that is implemented or explicitly planned in the product. When a control depends on configuration, a provider, a secret, a contract or legal approval, that dependency must remain visible.
AUD-2.0 baseline
The current technical policy uses 2555 days for compliance evidence. This is a product configuration, not a universal legal opinion.
retention_until
Each compliance event receives a calculated retention date when written, making retention observable at the evidence level.
Legal hold
When investigation or litigation requires preservation, legal hold prevents disposal while the obligation remains active.
Other data classes
Measurement responses, leads, analytics, billing and other data may need separate lifecycle policies and do not automatically inherit the AUD-2.0 baseline.
Legal alignment
Final retention schedules should consider applicable privacy law, tax rules, contracts, litigation policy and customer requirements.