Data Retention & Deletion Policy

Effective date: 2026-10-19 Policy version: retention-2026-10 Applies to: ATHELOS Cloud (multi-tenant SaaS), Dedicated instances, and Self-Hosted deployments operated by ZERODIN.

1. What this policy covers

ATHELOS stores three categories of data:

This policy states how long each category is retained and when it is destroyed.

2. Tenant business data

Tenant business data lives in three places: the tenant's Postgres database (athelos_tenant_<slug>), the tenant's MinIO bucket (tenant-<slug>), and the tenant's Meilisearch index (tenant_<slug>_kb).

2.1 Retention by tenant state

The clock-start column matters: for pending_payment, the abandonment clock starts at created_at (when signup happened). For cancelled and suspended, it starts at updated_at (when the status changed). A tenant that signed up 8 days ago but cancelled yesterday is not eligible for deletion as abandoned — the cancelled rule applies (30 days).

2.2 What "deletion" means

When a tenant is deleted via tenant.delete job, the following are destroyed:

1. Cloudflare DNS A record (<slug>.athelos.pro) — removed via API
2. MinIO bucket (tenant-<slug>) — emptied, then removed
3. Meilisearch index (tenant_<slug>_kb) — removed
4. Postgres database (athelos_tenant_<slug>) — dropped with DROP DATABASE ... WITH (FORCE)
5. Control-plane tenant row — deleted, which cascades to users, sessions, and subscriptions via ON DELETE CASCADE

After deletion, the tenant no longer exists in any form except for:

• A hashed audit entry in tenant_deletion_audit (see §3)
• The billing record in Stripe (required for tax/audit compliance — see §4)

2.3 Backups

The tenant's database, MinIO bucket, and Meili index are backed up via restic to Backblaze B2. The retention of backups follows the backup rotation policy, not this data-retention policy. When a tenant is deleted, the most recent backups are also removed by the next restic prune cycle.

3. Audit logs

3.1 tenant_deletion_audit

When a tenant is scheduled for deletion, a row is written to tenant_deletion_audit before the deletion job runs. The row records:

• A SHA-256 hash of the tenant ID (salted with AUDIT_SUBJECT_SALT) — never the plaintext tenant ID
• The tenant slug
• The reason (cancelled, suspended, or abandoned)
• The policy version (retention-2026-10)
• The scheduled timestamp
• The completion timestamp (when the delete job finishes)
• The status (pending, completed, or failed)
• Any error message if the deletion failed

Retention: 7 years from scheduled_at. This matches the tax-record retention requirement and is the minimum required to demonstrate GDPR Article 30 compliance during an audit.

3.2 webhook_events

Every Stripe webhook event is recorded in webhook_events for idempotency and audit. Retention: 90 days from created_at. After 90 days, the row is eligible for archival (via a future scheduled cleanup job) but is currently kept indefinitely pending that implementation.

3.3 Verification tokens

verification_tokens rows are short-lived:

• Expire 24 hours after expires_at
• Deleted immediately upon successful use (the used_at timestamp is set, and the row is retained only until the retention cleanup removes it)
• Retention: the row is retained until the password hash is no longer needed. Currently kept until manual purge — a future scheduled cleanup will remove expired and used tokens after 30 days.

4. Billing records

Payment records (Stripe customer ID, subscription ID, invoices) are retained for 7 years to satisfy tax and accounting obligations in the EU and US. This retention period applies even after the tenant is deleted from the ATHELOS system — the billing record is held by Stripe, not by ATHELOS, and Stripe's own retention policy applies.

5. GDPR Article 17 (right to erasure)

A data subject may request deletion of their personal data at any time. The ZERODIN operator:

1. Receives the request (via privacy@athelos.pro or the customer's tenant admin)
2. Verifies the request originates from an authorized party for that tenant
3. Manually enqueues tenant.delete with reason: "gdpr"
4. The delete job runs immediately (not waiting for the retention threshold)
5. A hashed audit row is written to tenant_deletion_audit
6. The data subject is notified within 30 days of the request (per GDPR Article 12(3))

Note: the retention thresholds in §2.1 do not override a GDPR erasure request. A customer's GDPR request deletes the tenant immediately regardless of status or age. The retention schedule is the default deletion timeline, not the maximum.

6. How this policy is enforced

This policy is not aspirational — it is backed by code:

Any change to the code above must be reflected in this document in the same commit. The policy version retention-2026-10 appears in every audit row so future audit can tell which policy was in effect when a deletion happened.

7. Changes to this policy

Material changes to this policy (extending or shortening a retention period, changing the deletion scope) require:

1. A bump to the policy version constant (POLICY_VERSION in both scan jobs)
2. An update to this document
3. Notification to affected customers 30 days before the change takes effect

Minor clarifications (spelling, examples) do not require the above.

8. Contact

For questions about this policy or to exercise a data subject right:

• Email: privacy@athelos.pro
• For urgent breach-related matters, see docs/legal/INCIDENT-RESPONSE.md