Trust · Data retention and deletion
Can we keep what we must and delete what we should?
Retention schedules, legal holds and deletion exist and are tested locally. Removing every copy from storage and backups, and a customer request flow with a stated time, are not complete.
No certification, audit or independent assessment is held. Each statement below shows how sure the project is of it.
What exists, and how sure we are
- Partly in placeRetention schedules, legal holds and deletion are implemented and covered by local tests.Recorded in the pilot evidence pack.
- Partly in placeDeleting copies in storage and backups, and a request flow a customer can use, are not complete or verified.Recorded in the pilot evidence pack.
- Tested locallyEvidence records are append-only: the account the application runs as cannot delete them.Recorded in the security assurance record.
- Reviewed in codeAn approved procedure version cannot be changed, and recordings carry a legal hold and a deletion that removes metadata.Recorded in the security assurance record.
- Partly in placeA restore from backup has been exercised locally, not on a deployed environment, and no recovery time has been measured.Recorded in the pilot evidence pack.
- Partly in placeOffboarding has export and deletion as building blocks, but a stated time for completing a request is not in place.Recorded in the pilot evidence pack.
See it in an example
Simulation. A scripted example on fictional data. The wording is scripted and no model is called; the figures are computed from what you decide, and a person’s approval covers exactly what you decided.
Decide what a deletion request can remove
- What happened
- Marlow Dental Group (fictional) is closing a clinic and has asked the vendor to delete everything about it, but some of it is under a legal hold or is part of the audit trail.
- The question
- Which items can go now, which must wait, and which can never be removed by the customer? Asked by: Data protection lead at a customer (fictional).
Decide what a deletion request can removeEach flagged item has a reason it cannot simply be deleted. Mark it to wait, or to ask for an exception; the records that could go now are recomputed.Open
Each flagged item has a reason it cannot simply be deleted. Mark it to wait, or to ask for an exception; the records that could go now are recomputed.
Review each flagged record: confirm it or dismiss it. The totals and the answer below follow your decisions.
Item Held in Status Records affected Finding Decision Clinic training recordings Object storage No hold 120 Matched None needed Unpublished draft procedures Database No hold 64 Matched None needed Approved procedure versions Database Immutable once approved 38 Approved versions cannot be changed; deleting one hides it rather than erasing it Recordings under a legal hold Object storage On hold 14 A legal hold is in place: nothing may be deleted until it is lifted Decision ledger entries Database, append-only Evidence record 410 Evidence records are append-only: the application cannot delete them Copies in backups Backup storage Not covered 1 Deleting copies in backups is not complete or verified Transcripts Database No hold 97 Matched None needed Staff training certificates Private storage Revocable record 22 A certificate can be revoked, but it is kept as a record - Flagged
- 5 of 8 · 485
- Must wait
- 0 · 0
- Ask for an exception
- 0 · 0
- Undecided
- 5 · 485
5 of 8 items cannot simply be deleted; you marked 0 to wait (0 records) and 0 to ask for an exception.
Deletion removes what no hold or evidence rule protects; the rest is hidden, held or kept as a record by design [S1].
Removing every copy from storage and from backups is not complete, and no time for completing a request is stated today [S2]. 5 flagged item(s) are still undecided.
Relies on: S1 · Deletion request and the hold register (fictional)S2 · The retention and deletion status in the project's records
The customer's data protection lead with the vendor decides. Approving records which items wait and which exceptions are requested. It does not delete anything or lift any hold.
Not ready. 5 flagged items are still undecided. Confirm or dismiss each one first.
Not done here. It does not delete, lift a legal hold or promise a deletion time: backups and a stated completion time are not yet in place.
What a reviewer can have, and what not yet
- We can hand overThe retention and deletion tests, and the offboarding steps as they exist for a synthetic organisation.
- We cannot yetA deletion exercised end to end on a deployed environment, deletion from backups, and a stated time for completing a request.
The capabilities behind this
- Retention, holds and where work is processedRecords are kept too long or deleted too soon, and nobody can show why.
- Privacy and Data RightsData-rights requests, data-processing agreements, breach-response support, retention, transfer rules and privacy obligations, joined to the privacy workspace and the…
The other nine
- Customer-controlled accessAccess by organisation, role and location, decided on the server, and what stops when it is withdrawn.
- Read-only database connectionsWhat a read-only connection proves before every use, what it cannot do, and what a customer's administrator should check first.
- Uploaded dataLimits, what is read and what is not, and the checks that are not done.
- AI provider disclosuresWhich features can send content outside the platform, what they may send, and what has not been established.
- Encryption and access controlsWhat protects sign-in, sessions and secrets, and the controls that only a live inspection can settle.
- Audit evidenceA tamper-evident decision record, what it proves, and what it cannot.
- Human approvalsWhat an assistant may draft or propose, what it refuses, and how a person's decision is recorded.
- Customer-hosted and dedicated deploymentUpload, read-only connection, natural-language questions, a customer-hosted connector and a dedicated environment: what exists.
- Pilot security requirementsThe twenty-item gate, what it counts, and what is open.