Data retention and residency
Define retention, deletion, location, and export requirements for business data.
Retention defines how long a category of data remains available. Residency identifies where it is stored or processed. Review both for the products and deployment model your organization uses.
Identify the data categories
Establish the retention and location requirements for each category:
| Category | What to establish |
|---|---|
| Account information | Profile lifecycle and personal-data request handling |
| Organization audit records | Retention window, export needs, and investigation requirements |
| Product data | Primary storage, replicas, backups, evidence, and deletion lifecycle |
| Financial records | Invoice and payment record retention after service closure |
| Exports | Who holds copies and when your business removes them |
| External integrations | Which provider receives data and its retention process |
Use the relevant product guide for storage and recovery behavior. For self-hosted deployments, your organization must also account for infrastructure, backups, and integrations it operates.
Establish requirements before deployment
Send support the products, deployment model, required regions, data categories, retention periods, and any preservation obligations. Ask for the applicable contractual and technical coverage. Use security and compliance for procurement review.
A preferred region for a workload does not describe every support system, billing record, backup, or external processor. Identify those separately when residency is a contractual requirement.
Plan deletion
Before closing an organization, identify records to export and any hold or retention requirement that affects deletion. Request confirmation of the categories being removed or retained and the relevant lifecycle.
Removing a personal account does not establish deletion of organization-owned data or business exports. Review those separately with the authorized business contact.