Data retention
Last updated: September 18, 2026
This page records explicit retention windows for data classes that are not implicitly bounded by their parent record’s lifecycle. Anything not listed here lives until its parent organization, project, or user is deleted.
Retention table
| Data class | Retention period | Why |
|---|---|---|
| LangGraph chat checkpoints (compliance-chat-…) | Until user account deletion, organisation deletion, or 30 days — whichever comes first | Blobs hold verbatim user document excerpts and free-text chat turns (GDPR personal data) |
| LangGraph orchestrator checkpoints (run-…, qms-…) | Until organisation deletion, or 30 days — whichever comes first | Same as above |
| LangGraph requirement-analyst checkpoints (req-…) | 30 days | Requirement IDs are global, so the thread cannot always be mapped back to a user or organisation at deletion time. This is the user-visible residual window described in Privacy Policy §8. |
| Personnel inventory (people, person_accounts) | Until organisation deletion | Employment and tool-account join for offboarding evidence |
| Device inventory (assets) | Until organisation deletion or connector disconnect | Managed hardware roster from MDM (name, owner email, encryption, compliance) |
| Outbound questionnaire packs | Until organisation deletion or customer-admin delete | Extracted audit questions, cited drafts, reviews and internal notes. Source spreadsheets are not stored. |
LangGraph agent checkpoints
Retention: 30 days from the agent run that created the row. These tables hold serialised intermediate state for every agent run — compliance chat, compliance orchestrator, requirement analyst, QMS setup, document generator. The blobs include verbatim user document excerpts and free-text chat turns that constitute personal data under the GDPR.
- On user account deletion, chat-session checkpoints under compliance-chat-{sessionId}- are purged.
- On organisation deletion, checkpoints under compliance-chat-, run-{projectId}-, and qms-{orgId}- prefixes are purged. req-{requirementId}- rows are evicted only by the nightly cron.
- A nightly retention job deletes anything older than the cutoff. The default 30-day window is configurable by Isodora (clamped to 1–365 days).
Configuration
- The 30-day default can be shortened or extended by Isodora within 1–365 days.
- Lowering it shortens the residual window for requirement-analyst threads.
Other classes
- Evidence retention is currently bounded by organisation lifecycle.
- Audit-log entries are anonymised on user delete and are not separately time-bounded.
- Remediation-task history is bounded by project lifecycle.
