# 25 Data retention and disposal policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | Security Owner |
| Review | Yearly |
| Applies to | All customer data and logs in in-scope systems |

## Retention schedule

The retention schedule is the table in the [universal baseline](/playbook/02-universal-baseline#retention), which this policy adopts. An app register entry may set a shorter period for its product; it may not set a longer one without a documented legal reason. In summary:

| Data | Retain |
| --- | --- |
| Account and profile data | Life of account plus 30 days |
| Customer content (mail, files, documents) | Until the customer deletes it, or account closure plus 30 days |
| Recordings and transcripts | Customer-set, default 90 days |
| Invoices and payment records | 8 years (India), 7 years (US tax) |
| Server and access logs | 1 year (180 days minimum, CERT-In) |
| Security and audit logs | 1 year |
| Backups | 30 daily, 12 monthly |

## Disposal

1. A scheduled reaper deletes data that has passed its retention period, monthly at least. Each run logs what classes and how many records it removed, never the content (CNF-03).
2. Deletion requests from customers or data principals are verified, completed within 30 days, logged, and propagate to backups within 90 days or on restore.
3. **Contract end:** when a business customer leaves, their data is exported on request within 30 days and then deleted; the customer is told the deletion date in writing (CNF-04).
4. Media disposal follows [14](/soc2/14-asset-data-management#disposal-of-media).
5. Legal hold: when litigation or a regulator requires it, the Security Owner suspends deletion for named data and records the hold and its release.