Data Retention
This page documents what Align stores, for how long, and how it is deleted - the written retention policy behind our "we process, we don't hoard" commitment.
What Align stores
| Data | Stored? | Retention |
|---|---|---|
| Extracted decisions (title, rationale, status, links, metadata) | Yes | For the life of the tenant, until deleted by an admin or by user-deletion request. This is the product. |
| Raw source message text (Slack/Jira/GitHub/etc. bodies) | No | Processed in memory during analysis, then discarded. Not retained at rest. |
| OAuth tokens for connectors | Yes (encrypted) | Until the connector is disconnected; then deleted. |
| Import jobs & suggestions (transient scan state) | Yes | Purged automatically after 33 days (subject to legal hold). |
| Audit logs (mutations, access denials) | Yes | Retained for the tenant; protected by legal hold when set. |
| Embeddings (vector representations for search) | Yes | Lifecycle follows the decision they describe. |
Raw text is not retained
On the live capture path, raw message text is cleared in a finally block after
the decision is extracted, so retention never depends on the analysis succeeding.
On the historical-import path, the suggestion's raw-content column is forced empty
and the rows themselves are purged by the 33-day job. The net effect: Align does
not retain Slack, Jira, or GitHub message bodies at rest.
Deletion
- Connector disconnect removes that connector's stored OAuth credentials.
- User deletion (GDPR Article 17) removes the user and, where not under legal hold, their associated records. A full export (Article 20) is available first via the admin export endpoint.
- Tenant offboarding removes tenant data on request.
Legal hold
Admins can place a legal_hold_until timestamp on decision snapshots and audit
logs. While a hold is active, the retention purge and deletion paths skip the held
records, so data required for litigation or investigation is preserved.
Backups
Infrastructure backups (RDS automated backups, AWS Backup vault lifecycle) follow their own schedule and are encrypted at rest. Deletion of production records does not immediately purge them from point-in-time backups, which age out per the backup retention policy.