Data Retention Schedule
How long each category of Registry record is kept, why, and how it is disposed of at the end of its retention period.
1. Principles
Records are kept only as long as they are needed for the purpose they were collected for, to meet legal and regulatory record-keeping obligations, or to preserve the integrity of past verifications. At the end of the period, records are deleted, or anonymised where aggregate statistics are needed.
2. Schedule
| Record | Retention period | Reason |
|---|---|---|
| Declined or withdrawn applications | 5 years from decision | Fraud prevention; defence of claims |
| Applications that led to issuance, and due-diligence records | Life of registration + 5 years after the final code is revoked or registration ends | AML record-keeping (UK MLR 2017 reg. 40; FICA; PCMLTFA; FOR T&T) |
| Reserve Ledger entries (sealed profile, code, fingerprint, chain hash) | Life of registration + 10 years | Integrity of the hash-chained Ledger and of past verifications, seals and appeals |
| Verification log (every attempt) | 7 years (automated purge) | Audit, dispute resolution and regulator enquiries |
| Authorizations to Verify | Life of registration + 5 years | Evidence of the holder's consent to each disclosure |
| Document seal records (Seal ID, SHA-256, dates) | Life of registration + 10 years | Documents may be relied on for years after sealing |
| Uploaded documents (for sealing or seal checks) | Not retained — hashed in memory and discarded | Data minimisation |
| Requests for access not confirmed from the corporate mailbox | 90 days | Prevention of duplicate and abusive requests |
| Decided requests for access (approved or declined) | 24 months from decision | Applying the twelve-month bar in the Invitation & Access Policy |
| Invitations | Life of registration + 5 years (invitations that were not used: 24 months) | Evidence of how each application entered the Registry |
| Single-use mailbox links (stored as keyed hash) | 30 days | Security |
| Unconfirmed holder requests | Expire after 30 minutes (ATV) to 14 days (seal lock); purged after 90 days | Security |
| Staff audit log | 7 years | Accountability |
| Email delivery log (recipient stored as keyed hash) | 2 years | Troubleshooting and evidence of notice |
| Rate-limit counters | 48 hours | Security |
| Application and security logs | 12 months | Security monitoring and incident response |
| Complaints, appeals and speak-up reports | 6 years from closure | Defence of claims; oversight |
3. Legal holds
Where records are relevant to litigation, a regulatory investigation or a law-enforcement request, deletion is suspended until the matter ends.
4. Disposal
Database records are deleted with secure deletion routines, and backups age out on the backup provider's rotation cycle, which does not exceed 90 days. Keys that protect retired records are retired under the key-management procedure described in the Security Overview.
5. Review
This schedule is reviewed annually and whenever relevant laws change.