| Data | Kept |
|---|---|
| Raw screen frames | Never. Dropped right after redaction |
| Redacted keyframes | In the server database, until removed |
| Session log (transcripts, screen events) | In the server database, append-only |
| Struck content (“strike that”) | Removed; only a tombstone marker remains |
| Voice clips | Only with consent |
| Web lookup cache | 7 days |
| Check log (agents) | In the server database, until removed; record up to 16,000 characters per row, PII-redacted unless your workspace stores it as sent (check log) |
| Approvals, overrides, outcomes | With the check log, under the same retention setting |
| Evidence log (the hash chain and signed checkpoints) | Until an admin sets a retention period (Admin → Evidence → Retention, or PUT /api/evidence/retention), which can’t be under 183 days (six months). Pruning then removes older checks, approvals, overrides and outcomes with their chain entries, after a signed checkpoint. Rule versions are never deleted. Nothing is pruned until an admin runs it (Prune now, or POST /api/evidence/prune) |
| Connector decision items (messages, reviews, documents, issues read from Slack, GitHub, Google Drive, Notion, Linear) | In the server database, with their authors and who can see them. Disconnecting a connector deletes its token and the items not yet mined; mined items stay as the sources of the proposed rules |
| Proposed rules (mined or learned) | Until confirmed, edited or rejected; the decision is kept |
| Accounts, sessions, keys | Sessions 14 days; keys until revoked; only hashes of secrets |
Where it’s stored
The Claros server is self-hosted: its database, keyframes and clips live on persistent volumes on the machine that runs it, and survive deploys and restarts. A nightly backup copies the database and media to the same machine; the newest 14 are kept.There is no automatic retention schedule or self-serve delete for sessions, maps or connector items yet. Use “strike that” during a session, or ask us to delete data.