Backup retention and legal holds
Expire recovery points while preserving retained chains and explicit holds.
Backup retention determines which completed recovery points remain recoverable. A retention rule selects recovery points; physical deletion also depends on shared data, destination policy, and legal holds.
Retention tiers
Set tier counts at Storage → Backup policies → Policy → Retention. Inspect retained points and expiration reasons at Storage → Backups → Recovery points.
A policy can keep recent daily points and a smaller set of weekly or monthly points. Each retained point carries its original capture time and the rule that keeps it. When several tiers select the same point, it remains one recovery point with several retention reasons.
Retention runs after a completed copy and during scheduled cleanup. Failed or incomplete transfers do not advance the newest usable recovery point. Infra does not expire the last required recovery point merely because another run was scheduled but failed.
Incremental dependencies
An incremental backup can share data with earlier recovery points. Expiring an older visible point does not delete blocks still required by a retained point. The cleanup operation tracks dependency references and reports reclaimed space separately from the number of expired manifests.
Deleting an external object manually can damage more than one recovery point. Use the managed expiration workflow rather than editing backup buckets to clear space. Run verification after any uncoordinated destination change.
Hold a recovery point
Open Storage → Backups → Recovery points → Recovery point → Holds → Add hold. Release a hold from the same list after reviewing the remaining retention reasons.
An authorized Auditor or administrator can apply a hold with a reason, owner, and review date. A held point is excluded from ordinary expiration. Removing the policy, deleting the source droplet, or closing the project does not remove that hold.
A destination-enforced retention lock is separate from an Infra hold. Releasing the Infra hold cannot shorten a storage-provider lock. The console shows both reasons when deletion is blocked.
Change the policy
In Storage → Backup policies → Policy → Retention, preview the set that becomes eligible for expiration before reducing retention. Use the selection and expiration preview for automation. The preview includes source resources that no longer exist. A lower retention value can make old recovery points immediately eligible on the next cleanup run.
Changing a destination for future runs does not move or expire copies at the previous destination. Keep its credentials and encryption material until every required point there has expired or been migrated through a supported copy.
Deletion failure
A cleanup run can expire a manifest while object deletion remains blocked by a provider lock or temporary access failure. The run reports retained bytes and its retry condition. It does not report that space as reclaimed.
Removing a backup destination is blocked by retained recoverable points and unresolved cleanup references. Use Backup policy API for retention changes and data residency for approved archives.