Data Retention

dataRetentionConfig controls data lifecycle across all tenant data. Every tenant currently gets the defaults below — there is no dashboard endpoint to change the retention-day fields directly. The one exception is auto_redact_pii, which is toggled through a separate top-level piiProtection field (see PII handling below), not by sending a dataRetentionConfig block.

Schema

{
  "dataRetentionConfig": {
    "session_retention_days": 30,
    "message_retention_days": 90,
    "artifact_retention_days": 365,
    "embedding_retention_days": 365,
    "audit_log_retention_days": 730,
    "auto_redact_pii": true,
    "pii_retention_days": 7
  }
}

Retention periods

In practice, the nightly retention job purges non-flagged, non-critical/error audit log entries after a fixed 30 days platform-wide — it does not currently read this field. Flagged and error/critical-severity entries are kept regardless of age.

Setting any field to null disables automatic purging for that data type (data is kept until manually deleted).

PII handling

auto_redact_pii

When true, PII detected in messages (names, email addresses, phone numbers, national IDs) is automatically redacted before storage. Default: true.

Redacted fields are replaced with [REDACTED] markers. The original content is never stored.

To change this from the dashboard API, send a top-level piiProtection boolean — not a nested dataRetentionConfig.auto_redact_pii field:

PATCH https://api.liyaengine.ai/dashboard/account/config
Authorization: Bearer <dashboard_jwt>
Content-Type: application/json

{ "piiProtection": false }

pii_retention_days

How long PII-containing data is retained before purge, even if message_retention_days is longer. Default: 7 days. Setting this short ensures PII is not retained beyond what is operationally necessary.

Consent flags per request

Individual requests can override retention behaviour at the user level using the consent field:

{
  "input": { "user_id": "usr_123", ... },
  "consent": {
    "allow_data_storage": false,
    "allow_session_memory": false,
    "allow_embeddings": false,
    "allow_analytics": true,
    "data_retention_days": 1
  }
}

When allow_data_storage: false, the request is processed but no messages or session data are persisted. Useful for privacy-sensitive workflows or when a user has opted out of data storage.

Compliance

• Audit logs are immutable and tamper-evident
• All data is scoped by tenant_id — no data is shared between tenants
• GDPR data subject access requests and deletion requests should be handled via the admin API or by contacting support