Data Retention & Archival Policy
FVI retains customer data only as long as required to deliver the service, satisfy legal and regulatory obligations, and support audit. Tenants may extend retention per data class; reductions below the platform minimum are not permitted.
| Data class | Retention | Basis |
|---|---|---|
AI usage telemetry Per-call usage and cost metering supporting AI governance and chargeback. | 730 days | AI governance audit trail (2 years) |
aidp_output_recon_invalidations | 90 days | AIDP→Recon invalidation index — short-lived |
aidp_pages | 90 days | AIDP page binaries — short-lived working set |
Audit log Hash-chained, append-only system audit. Never auto-purged — held for the full SOX 7-year window and archived to immutable cold storage thereafter. | 2557 days | SOX / SOC2 / 7-year regulatory minimum |
Email delivery log Transactional and digest email delivery records for CAN-SPAM and bounce diagnostics. | 365 days | CAN-SPAM / deliverability investigation window |
recon_exceptions | 395 days | Break management evidence (13 months) |
recon_matches | 395 days | Match audit trail (13 months) |
Reconciliation runs Tenant-configurable. Default is 13 months to cover regulatory year-end review windows. | 395 days | Tenant default 13 months; overridable per tenant |
Security events Authentication, MFA, SSO and step-up events for SOC 2 CC7.2 investigation. | 730 days | SOC2 CC7.2 incident detection (2 years) |
What we store and why
We store the records you upload (statements, trades, GL extracts), the matches and breaks our engine produces, and the operational metadata needed to audit, secure, bill, and improve the service. We do not sell customer data and we do not use it to train third-party models.
Tenant overrides
Tenant administrators can extend retention for any tenant-configurable class up to 10 years from Tenant Admin → Settings → Data retention. Reductions below the platform floor are rejected by the database. The audit_log class is regulatory-fixed and not configurable.
Purge cadence & cold-storage archive
Nightly server-side jobs purge data past its effective retention; every purge bucket emits a security_events row of type retention.purge. Where an archive prefix is configured, rows are copied to write-once, region-pinned object storage with SHA-256 anchoring before deletion.
How to request a copy of your data (GDPR Art. 15)
Contact privacy@falconveritas.com to request a copy of your data. We may need to verify your identity or clarify the scope; handling follows applicable data-protection law and the terms for the service.
How to request deletion (GDPR Art. 17)
Deletion requests are assessed against applicable law, contractual retention terms, and any records that must be retained. The scope, purpose, and applicable period for retained records are explained as part of the request review; this page does not promise a fixed completion window.
Sub-processors
The sub-processor register, including purposes, data categories, regions, and transfer details, is available at /legal/subprocessors.
Changes to this policy
Material changes and notice requirements are governed by the applicable contract and privacy notice. Refer to those documents for the current terms.
Questions? Contact privacy@falconveritas.com.