Control
Keep what you must. Remove what you should.
Set how long data is kept, pause deletion for a legal hold, and erase on request without breaking proofs.
Retention
By kind of data- Request payloadsDelete after90 days
- Reviewer commentsDelete after1 year
- Signed receipts and proofsKeepKept
- Case 2026-044 legal holdDeletion pausedHold
Erase on request
- Request received
- Personal fields removed
- Hashes and signatures kept
- Proofs still verify
Legal hold
- Scope
- Refund requests, Oct 2026
- Placed by
- Mia K.
- Deletion
- Paused
Why it matters
What legal hold and retention changes
- Set how long each kind of content is kept.
- A legal hold pauses deletion.
- Erase on request without breaking proofs.
- Data is kept forever, or deleted on a guess.
- A legal hold means one-off exceptions.
- Erasing a record breaks the audit trail.
The resultKeep what you must. Erase what you can.
What you get
Legal hold and retention, in practice
Retention rules
Choose how long request data is kept before it is redacted.
Legal hold
Freeze deletion for a case until the hold is lifted.
Proofs survive
A redaction is itself logged, and the signed record stays checkable.
How it works
Step by step
- 1
Set retention
A period for each kind of data.
- 2
Hold if needed
Deletion pauses for the case.
- 3
Time is up
Content is redacted. The fact of the decision stays.
- 4
Logged
The redaction is written down.
Questions
About legal hold and retention
Can I erase a person's data?
Yes. Erasure is a protected action, so it can need a second owner.
Does redaction break verification?
No. Hashes were taken over the original, and the redaction is recorded.
Next
Works well with
Know what your agents did.
Start free. Guard your first agent in a few minutes, and keep a record anyone can check.
- Free plan, no card
- Signed, chained decisions
- Checked offline, without us
Signed decision
- Decision
- Approved, 2 of 2
- Action
- refund.issue, £540
- Rule
- Two reviewers must agree
- Sealed
- 14:09, key 7f2c
- Hash
- 5be2…7c44
Checked on your own machine
- Signature matches the public key
- Decision is in the log
- Every link before it adds up