Retention

Data	Kept	Configured by
Audit log	365 days by default (30–3650)	Owners: Settings › Audit log or PUT /api/v1/audit/settings. A daily job at 03:00 UTC verifies the chain first and never prunes a broken chain; pruning writes an append-only checkpoint so the remaining chain stays verifiable.
Serving query log (metadata only)	90 days	Fixed; a daily job prunes it. Impact analysis and breaking-change checks read the last 30–90 days.
Schema snapshots, discovery runs, proposals	Kept (no automatic pruning in v1.0)	Deleting a source is a soft delete; its secret is destroyed at once.
Model revisions, releases, exports (with their zips)	Forever (the model's history)	—
Data-quality runs	Kept (no automatic pruning in v1.0)	—
Assistant conversations	Until the person deletes them	Result rows are never stored.
Notifications	Kept in the inbox (no automatic pruning in v1.0)	—
Channel delivery log	Kept	Pruning is a planned follow-up.
Serving cache (Redis)	Endpoint TTL, default 300 s	Per endpoint; 0 turns it off.
LLM response cache	24 h in process memory	Keel:Llm:CacheTtl
Idempotency keys	24 h	—

Tenant offboarding — deleting all of a tenant's data within 30 days, with a certificate (docs/07 §5) — is not automated in v1.0.