| Data | Kept for | Then |
|---|---|---|
| Edge request logs | 30 days raw · 90 days hashed | Deleted |
| Security alerts and incidents | 7 years | Archived, then crypto-shredded |
| Audit log | 10 years | Archived under legal hold rules |
| Session recordings | 1 year | Deleted |
| Whistleblower Portal client data | Not collected | — |