{
  "schemaVersion": 1,
  "publicSummaryVersion": "2026-09-30",
  "classification": "PUBLIC",
  "title": "Retention commitments and implementation gaps",
  "summary": "Retention policy v1.0 was approved on 9 September 2026 and published as final on 14 September. Checkpoints do not expire automatically while an account exists; destroying the account key makes them unreadable. Deleting a session erases the checkpoint content only it held: built and tested, served in production since 6 October 2026, and extended to sessions saved before then by a re-seal on 10 October 2026. A production check through the customer's own deletion route is still owed. No automatic expiry job is implemented, and several retention periods rely on procedure. Secrets written into a workspace are included in subsequent checkpoints.",
  "date": "9 September 2026 policy; 13 October 2026 implementation update.",
  "scope": "Published register or policy snapshot; per-item scope and dates apply.",
  "result": "Retention policy v1.0 was approved on 9 September 2026 and published as final on 14 September. Checkpoints do not expire automatically while an account exists; destroying the account key makes them unreadable. Deleting a session erases the checkpoint content only it held: built and tested, served in production since 6 October 2026, and extended to sessions saved before then by a re-seal on 10 October 2026. A production check through the customer's own deletion route is still owed. No automatic expiry job is implemented, and several retention periods rely on procedure. Secrets written into a workspace are included in subsequent checkpoints.",
  "sections": [
    {
      "title": "Policy v1.0 commitments and evidence gaps",
      "items": [
        {
          "id": "retention-checkpoints",
          "title": "Checkpoint content",
          "text": "Retained while the account exists, with no automatic expiry. Deleting a session erases the content only it held (served in production since 6 October 2026; sessions saved earlier were re-sealed on 10 October 2026); content a surviving fork shares stays that fork's. Account deletion destroys the key. Encrypted backup retention commitment: 30 days.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        },
        {
          "id": "retention-credentials",
          "title": "Provider credentials",
          "text": "Policy uses the same retention, deletion and backup terms as checkpoint content. Historical account-key erasure tests cover stored credentials.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        },
        {
          "id": "retention-billing",
          "title": "Ledgers and billing aggregates",
          "text": "Retained for 7 years under the stated legal obligation. Account identity is tombstoned on deletion. Backup treatment is not stated in policy v1.0.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        },
        {
          "id": "retention-logs",
          "title": "Service logs",
          "text": "Retention commitment: 30 days. Deletion and backup treatment are not stated in v1.0. No scheduled enforcement job or dedicated test is recorded.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        },
        {
          "id": "retention-support",
          "title": "Support tickets",
          "text": "Retention commitment: 2 years. Deletion and backup treatment are not stated in v1.0. No scheduled enforcement job or dedicated test is recorded.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        },
        {
          "id": "retention-audit",
          "title": "Console audit log",
          "text": "Retention commitment: 2 years; identity is tombstoned on account deletion. Backup treatment is not stated in v1.0.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        },
        {
          "id": "retention-account",
          "title": "Account data",
          "text": "Retained while the account exists, then deleted except for a tombstoned identifier and the stated billing aggregates. Backup treatment is not stated in v1.0.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        },
        {
          "id": "retention-telemetry",
          "title": "Telemetry",
          "text": "Retention commitment: 13 months, then deletion. Policy describes first-party cookieless telemetry without identifiers. Backup treatment and dedicated enforcement evidence are not stated.",
          "status": "Policy commitment; see implementation gaps",
          "date": "Approved 2026-09-09; published 2026-09-14"
        }
      ]
    },
    {
      "title": "Security and deletion limits",
      "items": [
        {
          "id": "workspace-secrets",
          "title": "Workspace secrets are checkpointed",
          "text": "A provider credential managed through the gateway is intended to stay outside the guest. Any secret an agent writes into its workspace becomes part of later checkpoints."
        },
        {
          "id": "expiry",
          "title": "No automatic expiry or supported legal hold",
          "text": "No category has an automatic expiry job in this record. The backup, log and support periods rely on procedure. Legal holds are not currently supported; the stated legal exception does not establish an implemented hold feature."
        }
      ]
    }
  ],
  "currentDeployment": "Not independently verified by this historical evidence.",
  "canonical": "/evidence/retention"
}