Data Retention & Deletion
Effective October 5, 2026/Approved by Evan Singer
Retention is data, not a habit
Every table that records events rather than current state carries a stated retention: either a period, after which a nightly job removes rows older than it, or keep-forever, with the reason recorded alongside it. A table with no stated retention is treated as a finding to fix, not as a default to fall back on.
The policy is held as data and the purge is code. A policy row naming a table the purge is not built to touch is reported and skipped, so adding a table to the purge is a reviewed code change and a bad row can never point a scheduled deletion at your business records. Every run writes what it removed and from where; that record is what an auditor reads.
Mail agent data is the one exception to that mechanism: it is deleted by the mail agent’s own job, which runs every ten minutes, rather than by the nightly purge. The periods in the table below are the same either way.
How long each class is kept
| Class | What it covers | Retention | Why |
|---|---|---|---|
| Telemetry | AI usage and cost per call, OCR counters | 13 months | One audit year, plus the month it is reviewed in. |
| Email delivery | Send acceptance and delivery evidence | 13 months | Evidence that a notice was sent and what became of it. |
| Security logs | Multi-factor attempts | 13 months | A full audit year of authentication activity. |
| Operational reports | Nightly agent reports, notifications | 13 months | A message log, not a record of work. The work lives in the task tables. |
| Mail agent: inbox items | For a mailbox its owner has connected: sender, recipients, subject, Outlook's short preview (at most 255 characters), the AI's one-line summary and classification, any deadline, a short reason for the routing suggestion, the ranking, and the owner's feedback. Never the message body | 30 days | Enough to sort a working inbox. Deleted immediately if the owner disconnects the mailbox. |
| Mail agent: filing suggestions | Suggested Legal and CRM filings: the attachment's name and type, the suggested counterparty and contract, and the email's subject and sender. Never the attachment itself | 30 days | A suggestion, not a record. A document the owner files becomes an ordinary Legal record and keeps a link to the email it came from. |
| Mail agent: connection | The owner's Microsoft sign-in tokens, encrypted | Until disconnected | Needed to read the mailbox at all. Disconnecting deletes the connection and everything above with it. |
| Audit records | Audit trail, GxP electronic-record trail, contract lifecycle, access changes, privileged staff actions, approval transitions, lot disposition, workstation sessions | Life of the record | Electronic records under 21 CFR Part 11, or the audit trail of one. Append-only, and disposed of with the tenant rather than on a schedule. |
The Part 11 exception, stated plainly
The keep-forever set is not a preference. Those records are electronic records, or the audit trail of one, under 21 CFR Part 11 §11.10(e), and each carries a database trigger that blocks deletion. They are retained for the life of the record.
The practical consequence is worth being direct about: in a validated system, an audit trail you can delete is not an audit trail. A tenant with even one audited write cannot be silently erased, by us or by anyone. Disposal is an act performed with you at offboarding, never on a schedule and never quietly.
Your business records
The records you put into Vered — orders, lots, contracts, invoices, accounts — are kept for as long as you are a customer. We do not age them out, and no scheduled job deletes them. What is described above is logs and audit trails, not your data.
Leaving
You can export your data on demand while you are a customer, without asking us. At offboarding we produce a full export and then dispose of the tenant with you, on the terms in your agreement.
Backups age out on their own schedule, so a record deleted today persists in backup for a period after that. We do not surgically remove single records from backups, and we would be suspicious of any vendor who claimed to.
Related
Subprocessors lists the third parties holding data, where it is hosted, and how we tell you about a breach. Security & compliance describes the controls and points at where each is enforced.
Questions, or a request for the underlying retention schedule in detail: legal@vered.io.
Questions about this document go to legal@vered.io.
← All legal notices