Retention and deletion

Overview

Retention should align to the workflow, the deployment model, and the customer’s policy obligations.

Public position

SupraOS is designed so retention can be configured according to customer requirements, workflow class, and legal or regulatory needs.

Data categories to consider

• Website inquiry data
• Updates / newsletter subscription data
• Workflow state
• Receipts / proof objects
• Generated outputs
• Logs and diagnostics
• Backups and archive copies

Public-safe defaults

• Website inquiry and marketing data is retained only as long as reasonably needed for communication, relationship management, legal compliance, and security purposes.
• Product / workflow data retention is intended to be configurable by customer requirements and contract.
• Deletion and retention behavior may be affected by legal, security, audit, or operational obligations.

Questions to answer in diligence

• Can retention be configured?
• Can data be deleted?
• What happens to receipts and evidence?
• What happens to backups?
• What is blocked by legal hold or policy?