Data Retention

The Pro Edition’s audit trail is bounded by policy, not by disk. Every request, decision, and fetch is recorded — and a daily purge job permanently deletes records once they age past the retention window.

The current window

90 days from request creation, for all Pro organizations. When a request crosses the window, the purge deletes the request row and its full event history — views, the decision, form submissions, and consume records — together, in the same pass.

Purged data is deleted, not archived: there is no recovery, export, or undelete. If your workflow needs records beyond the window, copy what you need — elicit_result for a request’s outcome, elicit_history for the summary listing — while the records are live.

Retention is not expiry

Two different clocks bound every request:

Clock	Bounds	Scale
timeoutSeconds (expiry)	How long the request stays decidable	Minutes to 24 hours
Retention window	How long the record of it exists	90 days

Expiry ends the decision; retention ends the evidence. Because expiry clamps at 24 hours, every record the purge touches has long been settled — approved, rejected, or expired — so the purge never races a live approval.

What this means in practice

• Fetch results promptly. elicit_result is idempotent and repeatable for the whole retention window — but not after it. An agent that parks an elicitationId for months will find “not found” where the record used to be.
• Dashboards and history age out. /dashboard, /dashboard/org, and elicit_history show what’s retained; entries disappear as they cross the window.
• The window is a default, not yet a dial. Per-organization retention windows (shorter for data-minimization, longer for compliance) are on the roadmap; today every organization runs the 90-day default.

The Privacy Policy documents the same commitment from the data- protection side.