Retention and Deletion Schedule
Operational schedule with supplier evidence and hold exceptions disclosed. Use your browser’s print command to save this complete version as PDF.
This schedule records numeric retention periods, operational controls and supplier-specific limits. Customer contractual commitments take effect through the accepted DPA and service order. For Customer Personal Data, an earlier DPA deletion deadline takes precedence over ordinary log, usage and support periods. Day means calendar day. Recorded legal holds and failed maintenance require documented exception handling and escalation.
1 Customer content and evidence
| Category | Retention trigger and limit |
|---|---|
| Contracts and document families | While the workspace service is active, or until an authorised deletion instruction. Delete active copies within 30 days of that instruction or service termination. Includes versions, extracted text, generated drafts, analyses and document relationships. |
| Signed documents and evidence | While the contracted workspace or archive service remains active. At termination, offer export within 15 days and delete active copies within 30 days unless Customer orders a separate archive term or a documented legal hold applies. Signing does not create an automatic indefinite archive. |
| Signing transaction metadata | Keep verification events and integrity evidence with their signed document for the same period. Expired invitations must stop working independently of record deletion. Evidence is included in the export and deletion assessment. |
| Accounts and memberships | Disable access when revoked. Remove account data within 30 days of an authorised account deletion, subject to remaining organisational ownership and the separately limited security or legal records. |
| Backups including off-host copies | Maximum 30 days from backup creation. A copy made immediately before active deletion may therefore remain for at most 30 further days. The ordinary outer limit is 60 days from a deletion request or termination. |
2 Return and residual copies
The export must include available original and generated documents, signed outputs and evidence, metadata and supported structured exports. Qedara will confirm scope and a secure delivery method with the authorised administrator. An account export alone is not evidence that every organisational record has been returned.
Backups remain access-restricted and are used only for recovery. Restoring a backup must reapply the deletion ledger and restrictions before ordinary service resumes. Legal holds apply to specified records; the existence of one hold must not extend retention for every workspace.
3 Logs telemetry and supplier copies
| Category | Proposed maximum or applicable rule |
|---|---|
| Security and workspace audit logs | Eligible at 365 days; daily purge, maximum ordinary residence 366 days. Recorded tenant and record holds are excluded. |
| Per-call AI metering | Eligible at 180 days; daily purge, maximum ordinary residence 181 days. Usage metadata only; content follows its own schedule. |
| Monthly usage aggregates | 24 months from the end of the usage month, then delete or irreversibly aggregate without tenant or user identifiers. Statutory invoice records are assessed separately. |
| Operational and error telemetry | QCM application/database container logs: operating limit 30 days, using hourly rotation and a 29-day expiry threshold. Contract bodies and credentials must not be logged. Supplier and infrastructure control-plane records are separate. |
| Authentication tokens | Expired tokens stop working immediately. TTL covers new records; legacy expired tokens are eligible after a 7-day grace and swept daily, maximum ordinary residence 8 days after expiry. |
| Support case material | Attachments and diagnostic text are eligible 90 days after closure, swept daily (maximum 91 days). Minimal case/event register: eligible at 365 days, swept daily (maximum 366 days). Recorded holds are excluded. |
| OpenAI provider copies | QCM sets store:false on the reviewed Responses adapter. Provider abuse monitoring can retain content for up to 30 days by default, with documented legal or safety exceptions; other endpoint features may have different state retention. No ZDR promise is made. |
| Resend provider copies | Resend publicly lists 30-day retention for Free, Pro and Scale transactional plans; Enterprise is configurable. Verify the Qedara account plan, deletion scope and any override before representing 30 days as the account-specific maximum. Source: https://resend.com/pricing (reviewed 19 October 2026). |
4 Execution and evidence
Daily maintenance covers metadata and support; backup and operational-log expiry run hourly. Records include scope, cutoff, hold exclusions, counts and outcome without copying content. Failed or skipped runs require incident review and retry. New holds are coordinated with maintenance before becoming effective; multi-tenant backup holds can temporarily pause expiry pending isolation of retained records.
Legal holds are reviewed every 90 days and removed when their basis ends. If a legal duty prevents deletion, Qedara records the specific duty and retention end date rather than using an open-ended “legal purposes” exception. Contact office@qedara.com for a request or a completion certificate.
Implementation evidence and remaining activation requirements
The assurance release enforces workspace AI disable, workspace/account erasure, metadata expiry and support-content expiry. Local and off-host current/history backup copies have an hourly expiry service, with a two-hour margin before the 30-day maximum, recovery prerequisites and hold checks. A 19 October restore verified 112 collections, 6,293 records and 72 stored files in isolation. The accessible Storage Box snapshot directory was empty at the 19 October inspection; account snapshot automation and contracted backup location still require account evidence.
From activation of version 1.2, an external ledger records hashed workspace/account erasure receipts and replays them before application or worker startup. Missing or older-than-30-day restore checkpoints fail closed. Receipts become eligible for deletion at 365 days with an hourly sweep; maximum ordinary active residence is 366 days. This control does not retroactively reconstruct document edits or individual deletions made before its activation. QCM application/database logs use an isolated journal with hourly rotation and expiry, within a 30-day operating limit. Supplier and infrastructure control-plane records have separate policies.