Purge policy assembly table
Purge policy: one sweep, every copy, proof without PII
retention days are ILLUSTRATIVE teaching numbers - real deadlines need a lawyer
data
retain*
purge mechanism
proof (no raw PII)
order record
365d*
sweeper deletes expired; hold blocks
tombstone id + hash receipt
cache + index
with record
purge keys with the record
purge log entry
event log
with record
append tombstone, then compact
offset + compact record
backups
90d*
expire + destroy old ones
destruction record
aggregates
derived
suppress cells with n<5
suppressed-cell list (re-identifiable)
audit log
minimal
hashes only, never raw PII
the log itself is the proof
breach read-off: orders + profiles present per table - precise location never collected, cannot leak
held row u2-order survives sweep + restore - resweep purges 0 - restore resurrects 0
* illustrative teaching days, not law - real deadlines need legal interpretation