Configuring Data Retention Policies

Data retention policies control how long SecureAI stores chat history, uploaded documents, and audit logs. Configuring these policies helps your organization meet compliance requirements and manage storage costs.

Prerequisites

Before you begin, ensure you have:

• Admin access to your SecureAI instance.
• An understanding of your organization's data retention requirements (industry regulations, internal policies, or customer contracts).
• Knowledge of which data categories your organization needs to retain and for how long.

Data Categories

SecureAI manages retention for three categories of data:

Important: Reducing retention periods deletes data permanently once the policy takes effect. This action cannot be undone.

Step 1: Access Retention Settings

1. Log in to SecureAI as an administrator.
2. Navigate to Admin Panel > Settings > Data & Privacy.
3. Select the Retention Policies tab.

Step 2: Configure Chat History Retention

Chat history includes all user conversations and AI responses. Consider your compliance needs when setting this value.

1. Under Chat History, select a retention period:

2. Optionally, enable User self-deletion to allow individual users to delete their own chat history before the retention period expires.
3. Click Save.

Compliance note: Some automotive industry regulations require that customer interaction records be retained for a minimum period. Consult your compliance team before setting retention below your regulatory minimum.

Step 3: Configure Document Retention

Uploaded documents may contain sensitive data such as VIN records, parts catalogs, or customer information.

1. Under Uploaded Documents, select a retention period:

2. Choose a deletion scope:

3. Click Save.

Note: When documents are deleted, any conversations that referenced those documents will still exist but the inline document previews and re-download links will no longer work.

Step 4: Configure Audit Log Retention

Audit logs are critical for security investigations and compliance audits. Consider retaining these for the longest period your organization requires.

1. Under Audit Logs, select a retention period:

2. Optionally, enable Audit log export to automatically export logs to an external system (SIEM, S3 bucket, or log aggregator) before deletion. See Exporting Audit Logs below.
3. Click Save.

Important: Audit logs have a minimum retention of 90 days regardless of the configured value. This protects against accidental misconfiguration that could compromise incident investigation.

Step 5: Review and Apply

1. After configuring all three categories, review the Policy Summary at the bottom of the page. It shows:
   • Current retention period for each category.
   • Estimated data affected if a retention period was shortened.
   • Next scheduled cleanup run.
2. Click Apply Retention Policies.
3. A confirmation dialog will appear showing exactly what data will be affected. Type the confirmation phrase to proceed.

Warning: Shortened retention policies take effect at the next scheduled cleanup (runs daily at 02:00 UTC by default). Data older than the new retention period will be permanently deleted.

Exporting Audit Logs

To retain audit data beyond the configured retention period, set up automatic export:

1. Navigate to Admin Panel > Settings > Data & Privacy > Retention Policies.
2. Under Audit Logs, click Configure Export.
3. Select an export destination:

4. Set the export frequency (daily or weekly).
5. Click Test Connection to verify the destination is reachable.
6. Click Save.

Exported logs are sent before deletion occurs, ensuring no data is lost during the retention cleanup process.

Compliance Considerations

Automotive Aftermarket Regulations

If your organization handles customer vehicle data, parts information, or service records through SecureAI:

• Customer data retention: Some jurisdictions require customer interaction records to be retained for a minimum of 1-3 years. Set chat history and document retention accordingly.
• Right to erasure: Even with long retention periods, individual data subject requests (e.g., GDPR Article 17) may require earlier deletion. The User self-deletion feature can help fulfill these requests.
• Audit trail requirements: Many compliance frameworks require immutable audit trails. Use the audit log export feature to archive logs to a system with immutable storage.

Per-User Overrides

If different user groups have different compliance requirements (e.g., customer-facing roles vs. internal analysts):

1. Navigate to Admin Panel > Settings > Data & Privacy > Retention Policies.
2. Click Add Override.
3. Select a user role or user group.
4. Configure retention periods specific to that group.
5. Click Save.

Per-user overrides take precedence over the global retention policy.

Verifying Your Configuration

After applying retention policies:

1. Navigate to Admin Panel > Settings > Data & Privacy > Retention Policies.
2. Check the Last Cleanup Run timestamp and Records Affected count.
3. Review the Retention Policy Audit Log (under Audit Logs > Filter > Retention Policy Changes) to confirm your changes were recorded.

Troubleshooting

Data is not being deleted after the retention period

The cleanup process runs daily at 02:00 UTC. If data persists beyond the expected date:

• Verify the policy is set to Active (not Draft).
• Check that the cleanup scheduler is running in Admin Panel > System > Background Jobs.
• If using per-user overrides, confirm the override is not setting a longer retention period for the affected users.

"Insufficient permissions" when configuring retention

Only users with the Super Admin or Data Privacy Officer role can modify retention policies. Check your role assignment in Admin Panel > Users > Your Profile.

Exported audit logs are not arriving

• Verify the export destination credentials in Retention Policies > Audit Logs > Configure Export.
• Click Test Connection to diagnose connectivity issues.
• Check that the destination system is not rejecting payloads due to size limits or format mismatches.

Related Articles

• How SecureAI Handles Your Data
• Audit Logging Setup
• User Management