Data Retention

• Default retention: 30 days.
• Minimum: 1 day.
• Maximum: what the tenant's contract sets, and never above the platform hard cap of 180 days — a cap the backend and the index garbage collector both enforce.

Retention is set per tenant within those bounds. The backend clamps any value outside them, so a tenant cannot be configured past the cap.

What happens at the end of the window

That depends on one switch the Customer owns, cold storage, which is off by default:

• Off — the default. When a log passes the retention window it is deleted from the searchable store and nothing is kept.
• On. The log is first copied to a compressed archive in Cloudflare R2 (Infrequent Access), and deleted from the searchable store only once that copy is uploaded and verified. The archive is kept until 1 year after the event's own timestamp, then deleted.

Archived logs are not searchable directly. A search that reaches into an archived range restores that range into a temporary index, which is deleted 24 hours later.

Beyond that one-year limit the Service keeps no logs, except transiently while the deletion process runs or where the law requires otherwise.

• Archiving, for tenants that turned cold storage on, exports each day of logs to the archive bucket before that day reaches the end of the retention window, and verifies every object it uploads.
• Log deletion from the searchable store runs once every 24 hours: it issues delete-tasks for documents older than the tenant's window — and, where cold storage is on, never for a day that is not archived yet.
• Archive deletion removes archived objects once they are 1 year past the event timestamp, and deletes each temporary restore index 24 hours after it becomes available.
• The log index also enforces a global garbage-collection cap as a backstop, so nothing accumulates past the maximum retention even if a task fails.
• Account metadata is deleted when the tenant, the account or the specific record is deleted.

Deletion is designed to be timely, but small operational delays between the retention boundary and physical removal can happen while those tasks run.

Account and configuration metadata persists while the account is active. On account deletion — or on a valid erasure request, subject to the controller and processor roles in the Privacy Policy — the associated metadata is removed. Invoices and similar records may be kept where accounting or tax law requires it.

We keep no separate backup copies of our own. The managed providers behind the database and the object storage maintain their own snapshots, with their own retention, so data that has been deleted from the live system may persist in a provider snapshot for a limited additional period before it is overwritten on that provider's cycle.

A tenant administrator changes the retention window in the console, at Settings → Retention, within the bounds above. The same screen holds the cold-storage switch.

Lowering retention moves older logs out of the searchable store on the next cycles — archived first if cold storage is on, deleted outright if it is not. The one-year cold-storage limit is the same for every tenant.

Questions about retention or deletion: Distriib LLC — support@distriib.com.