What you keep, and why

01In a nutshell #sec_4d0d24f2

Retention is not a checkbox: it is set category by category, it is observed in the report, and it is suspended by a reasoned measure when a procedure requires it.

02Where to find it #sec_c23ce8a2

Settings › Retention policy. This page is the front of the subject; two links at the top of the page lead to the two other screens.

03The durations #sec_bc0d8abf

Thirty-four data categories, grouped by trigger — campaign closure, issuance of proof, end of subscription, over time. The group answers the first half of the only question we really ask: from when, and for how long?

The nominal duration is not a disappearance date. Complete erasure occurs thirty-five days later, when the backups have expired. The right column writes it on two lines — how long, then from what — because confusing the two promises a disappearance that has not yet occurred.

Some durations are a minimum. The screen then displays at least . A campaign snapshot lives at least its nominal duration, and beyond as long as an unpurged proof depends on it. Displaying the value alone would be false.

You cannot disable a duration, and this is not a missing function. The list of units — days, weeks, months, years — does not know how to express infinity, and the ten-year cap closes the last path. A retention without term is not a retention, it is a forgetting to erase that no one will be able to explain.

Some lines are not set at all. An imposed duration is a legal obligation or data for which the publisher is responsible; a dependent duration strictly follows the object it accompanies. The screen says it with a padlock rather than graying out for no reason.

The derogation

Going beyond the profile limits requires a derogation, and it is recorded — it is not requested . The decision is made outside the product: legal advice, committee, internal arbitration. REVIEWIT provides the mechanism and the trace, not the arbitration.

Three fields are mandatory, and each answers a question that an auditor will ask years later: the reason, the approver — named with their identifier, because “the RSSI” is untraceable ten years later — and the review date . Lifting a derogation does not delete it: it has founded a retention, and the file must be able to explain it afterwards.

04What is actually purged #sec_a5a1e708

The screen displays an honest count: N categories out of 34 are actually purged . The others are not forgotten — they have no mechanism, and saying so is better than displaying thirty-four durations most of which would not apply to anything. A displayed but unapplied policy creates false proof of compliance.

A category can be purged without any line disappearing. When several categories share the same record, the purge is done field by field: the content leaves, the proof of delivery remains. The screen announces it — applied — content emptied — because a reader checking in the database would find their lines and conclude that the system is lying.

05The report #sec_a69c9127

It does not demonstrate what has been deleted: it explains what has been kept . The dark map is its heart — kept while eligible — and it is the part that the auditor reads.

Four reasons for retention, each with its three columns: who can act, when it is resolved, what usage restriction . Without them, a number per reason still leaves the question “so what?” unanswered.

No zero where nothing counts. A reason for which no mechanism measures the objects bears not counted, in dotted lines. A zero would affirm that nothing is kept under this title, which would be false.

And a counter that exists nowhere else: the number of categories that have not deleted anything at all. An all-green report may mean that the system is dead; this counter exists so that silence does not go unnoticed.

06Preservation measures #sec_7e4f6ae9

A measure suspends the purge of its target and what depends on it. It does not delete it: at the end, the purge resumes in the next cycle.

Placing a measure requires four things, and none are decorative:

The radius of action is calculated at the time of placement, never copied onto the held objects. This is what allows the lifting to trigger no processing: there is nothing to undo, the measure simply ceases to be found.

Lifting requires its own reason. It is the most exposed gesture of the two: placing protects, lifting removes a protection.

07The two silent failures #sec_07d6e553

A cycle that no longer deletes anything is identical to a cycle that had nothing to do. This is why each pass leaves a line in the log even when it purges nothing, and the report counts the categories that remained at zero. Without this line, a failed device and a resting device are indistinguishable.

A measure whose review is overdue still holds—but no one has confirmed that it should hold. This is the only red on the measures screen, and it deserves this treatment: a hold that has become unenforceable is more dangerous than an absent hold, because it looks like a valid hold.

08To remember #sec_7ae9ae73

• The nominal duration is not the disappearance date: count thirty-five more days.
• At least is not an approximation: it is a floor, and a proof can exceed it.
• You do not deactivate a duration. If you are looking for this button, the question lies elsewhere.
• The count « N out of 34 » is the most honest line on the screen. Read it before the durations.
• A conservation measure without term does not exist, and an overdue review is not a detail.