Retention, deletion and portable export
Purpose-based rules for credentials, evidence, released reports, audit records, backups and exit.
Draft v0.2 · statutory-minimum schedule proposed for counsel approval
Retention principles
- Keep information only for a documented service, security, contract, dispute or legal-record purpose.
- Separate short-lived operational records from evidence and released records whose integrity must be preserved.
- Record the approved period, trigger, owner, access class and deletion method for each category.
- Use a scoped legal hold with reason, owner and review date rather than a blanket deletion freeze.
- Never justify indefinite identifiable retention by convenience or model training.
Draft category schedule
| Record | Period/trigger | Exit treatment |
|---|---|---|
| Source secret | Only while authorised; disable immediately on revocation and destroy within 30 days unless a documented recovery or legal hold applies | Delete secret; retain non-secret version/revocation audit for seven years |
| Raw/canonical financial evidence, ledger and journals | Seven years after the end of the relevant financial year, transaction or final release; longer while a SARS audit, objection, appeal, investigation, dispute or scoped legal hold remains open | Portable export; restricted immutable retention to expiry, then verified deletion/de-identification |
| Released report, workpaper, approval and filing handoff | Seven years after the relevant financial year or release | Immutable retention or linked lawful supersession |
| KYB/KYT/Travel Rule and partner transaction evidence | Five years from the transaction/report or termination of the regulated relationship; seven years where the same item supports a financial/accounting record | Partner remains owner of its regulatory record; ChainClose restricts its orchestration copy to the documented purpose |
| Contracts, orders, billing, tax invoices and complaints | Seven years after termination, invoice/transaction or final complaint resolution | Restricted archive; no operational reuse |
| Privileged access and financial-action audit | Seven years after the event; longer only for an active incident, dispute or legal hold | Append-only restricted retention |
| Operational security, request and application logs | Twelve months; incident extracts up to seven years where required for defence or accountability | Rolling expiry with identifiers minimised |
| Workflow history and invitation claim material | Temporal closed history 30 days; invitation claim/secret seven days; delivery evidence seven years | Expire token/payload automatically; retain non-secret outcome lineage |
| Support records and unsuccessful sales enquiries | Support: three years after closure unless attached to a seven-year record; sales enquiry: twelve months after closure; never-paid inactive account: 24 months after last use | Delete/de-identify; retain minimum opt-out suppression while required |
| Operational backups | Cloud SQL: 30 daily backups and seven-day PITR; independent logical backups: at least 35 days; immutable evidence objects follow their seven-year record period | Encrypted rolling expiry; verified deletion is reapplied after a restore |
Verified deletion
Deletion requires authenticated authority, dependency and legal-hold checks, a logged request, active-system deletion or de-identification, provider propagation and a backup-expiry record. The target is 30 days for active systems and the next applicable rolling-backup expiry, unless law or a recorded hold requires retention. Where information must remain, access is restricted and the purpose, statutory/contractual basis and review date are recorded.
Portable exit
The supported export covers evidence indexes, canonical records, source coverage, policy/classification versions, ledger, reconciliations, journals, workpapers, reports, approvals and audit references in documented formats. It excludes secrets and another tenant's information.
Official sources
External references used for the factual and regulatory context on this page.