Data Retention

dataRetentionConfig controls data lifecycle across all tenant data. Defaults are set at account creation and can be updated at any time.

Schema

{
  "dataRetentionConfig": {
    "session_retention_days": 30,
    "message_retention_days": 90,
    "artifact_retention_days": 365,
    "embedding_retention_days": 365,
    "audit_log_retention_days": 730,
    "auto_redact_pii": true,
    "pii_retention_days": 7
  }
}

Retention periods

Setting any field to null disables automatic purging for that data type (data is kept until manually deleted).

PII handling

auto_redact_pii

When true, PII detected in messages (names, email addresses, phone numbers, national IDs) is automatically redacted before storage. Default: true.

Redacted fields are replaced with [REDACTED] markers. The original content is never stored.

pii_retention_days

How long PII-containing data is retained before purge, even if message_retention_days is longer. Default: 7 days. Setting this short ensures PII is not retained beyond what is operationally necessary.

Consent flags per request

Individual requests can override retention behaviour at the user level using the consent field:

{
  "input": { "user_id": "usr_123", ... },
  "consent": {
    "allow_data_storage": false,
    "allow_session_memory": false,
    "allow_embeddings": false,
    "allow_analytics": true,
    "data_retention_days": 1
  }
}

When allow_data_storage: false, the request is processed but no messages or session data are persisted. Useful for privacy-sensitive workflows or when a user has opted out of data storage.

Compliance

• Audit logs are immutable and tamper-evident
• All data is scoped by tenant_id — no data is shared between tenants
• GDPR data subject access requests and deletion requests should be handled via the admin API or by contacting support