Licensed to be used in conjunction with basebox, only.
// security
Retention
Applies to
Product: Cloud · Server · Audience: Security / Compliance reviewer
How long which data is kept: chats, documents, knowledge bases, audit log (configurable), uploads, logs and backups; defaults and what administrators control. Basic rule: content stays until a user or administrator deletes it. The audit log has its own retention period.
Retention by data type
| Data | Retention | Who controls | Automatic deletion |
|---|---|---|---|
| Audit log | 6 months, adjustable from 3 to 36 months (audit log retention) | Administrator (Audit & logging) | Via the retention period |
| Chat history | Locally in the browser, until the user deletes it or clears the browser data | User (Chat history & data) | No – not stored on the server |
| Chat uploads (files in a conversation) | With the conversation | User | On deletion of the chat |
| Knowledge base documents and their passages/embeddings | Until an administrator removes them from the knowledge base | Administrator (Knowledge bases) | No |
Temporary RAG files (/tmp/ragsrv) |
For the duration of processing | System | Yes |
| User accounts | Until an administrator deletes or deactivates them | Administrator | No |
| Invitations | Valid for 14 days | System | Yes – the invitation expires; the account is created only on acceptance |
| API keys | Until revoked | Administrator / developer | No |
| Per-user connector credentials | Until the user removes them or the account is deleted | User | With the account |
| System and application logs | 7 days. Server: deleted after 7 days unless you configure otherwise | Platform Operator (Server) · basebox (Cloud) | Yes |
| Backups | Cloud: 7 days. Server: per the operator's retention policy, e.g. retentionPolicy: "30d" in the CloudNativePG example |
Operator | With rotation |
| Model weights, caches | No personal data | – | – |
What this means for deletion requests
A deletion in the application takes effect in the database immediately, but backups keep the old state until their rotation. Whoever promises a retention limit must add the backup retention: with 30 days of backup retention, a deleted record has vanished from all backups after 30 days at the latest. Details: Deletion.
Audit log: level and retention
The audit log is the table with the most personal data (user identifier, timestamp, client address – and conversation content at level "High"). Two settings determine what and for how long:
- Audit Log Level: "Standard" (sign-ins as well as changes to settings and data) or "High" (additionally chats). As soon as content is recorded, all users see a notice in the chat. Set by administrators under Administration → Organization.
- Retention period: 6 months; administrators set 3 to 36 months under Administration → Organization.
Recommendation: retention as short as the evidentiary purpose allows; at level "High" considerably shorter than at level "Standard".
Per deployment model
- Cloud: you control the Audit Log Level, audit log retention and deletion by users and administrators. Log and backup retention of the platform are set by basebox as operator: system logs 7 days, backups 7 days (Backup).
- Server: everything sits with you – application settings with the administrator, log and backup retention with the Platform Operator (Logging, Backup & restore). Under operation by basebox the values are in the operations contract.
For the review
- Set the audit log retention (default 6 months) and document the value.
- Define a process for knowledge bases: who checks whether documents are still needed?
- Factor backup rotation into every deletion period.
- Record where audit log export files are kept and when they are deleted.
Next step: Deletion · Audit & logging