Data Retention & Deletion
Last updated: [date] — DRAFT, not yet in effect
Indavera uses a record-level Retention Policy Engine to determine how supported compliance records are retained, when deletion can be requested, what can lawfully delay deletion, and how the resulting action is recorded.
Record-level retention
Retention is attached to the record rather than merely to the customer account. Where an approved regulatory minimum applies, a tenant may extend the period but cannot shorten it below that minimum. If the platform cannot resolve an applicable retention period, the record is flagged as unresolved for human/legal review rather than assigned an invented deadline.
Deletion lifecycle
Supported records can move through five states: active, soft-deleted, retention-locked, purge-eligible, and purged. A soft-deleted record disappears from ordinary operational views but may remain preserved while a regulatory minimum or legal hold applies. Once no retention restriction remains, a supported record can become purge-eligible and its underlying content can be destroyed.
Legal holds
Authorized senior compliance roles can apply or release legal holds for matters such as litigation, regulator or law-enforcement requests, audits or examinations, internal investigations, preservation notices, disputes, or another documented reason. Multiple holds can apply independently, and each action is logged.
Current automated coverage
As of September 2026, KYC/KYB and STR/SAR are connected end-to-end to the automated retention/deletion engine. The platform also classifies account/profile data, transactions, screening results, alerts, cases, general onboarding records, generated compliance documents, audit/security logs, billing, prospect/support data, backups, and AI-generated artifacts, but those categories do not yet all have automated retention timers and purge hooks. Indavera therefore does not make a universal automatic-deletion commitment for them.
Account termination
Cancellation starts a controlled termination workflow. Workspace access is suspended; configured grace periods apply; tracked records are evaluated; records still subject to regulatory retention or legal hold are preserved; supported eligible records are purged; and third-party deletion or anonymization actions are initiated where technically available. The process creates an audit record. Exact grace periods and backup-expiry estimates are operational settings pending formal business/legal approval and are not stated here as fixed public commitments.
Backups and deletion evidence
The platform records an estimated backup-expiry date based on the configured backup lifecycle, but this estimate is not represented as proof that every backup copy has already been physically destroyed. Indavera maintains deletion evidence/audit records so the compliance lifecycle can be demonstrated without retaining the deleted substantive content.
STR/SAR confidentiality
Suspicious Transaction/Activity Reports receive special handling. Subject-access tooling excludes STR/SAR-classified records so the platform does not disclose the existence or contents of a filing to the person concerned where anti-tipping-off rules apply. When an eligible regulatory filing is purged, sensitive content can be scrubbed while a minimal tombstone — such as a case reference, filing date, regulator, and status — is retained to evidence filing history.
Third-party deletion
Termination workflows can anonymize/revoke identity-provider accounts, remove the Indavera-controlled Stripe customer payment profile and stored payment methods, and delete supported cloud-stored document files when their records are purged. Some third parties retain information under their own obligations or do not currently expose a customer-specific deletion interface; those cases are governed by the applicable vendor agreement and are not represented as immediate Indavera-controlled deletion. See Security & Subprocessors.
Privacy requests
For personal data processed on behalf of an Indavera customer, requests should ordinarily be made to that customer. Authorized customer staff can use Indavera tools to locate supported records and initiate access/deletion actions. Records that cannot yet be deleted because of a regulatory minimum or legal hold remain protected and are identified as not yet deletable. Identity verification of the requester remains the responsibility of the relevant controller/customer under its own process.
No fixed periods stated until approved
Engineering includes seed/example retention periods and configurable termination/backup windows, but the September 2026 engineering handoff marks those figures and regulatory citations as unverified or placeholder values pending business/legal sign-off. They are not treated as public contractual commitments until verified and activated.
Questions about this page: support@indavera.com.