Skip to content

Topic

Data retention

The policies and system settings that determine how long collected data is stored before deletion, shaping breach exposure and compliance risk.

Current stories

investOne report1 publisher

Mercadien's breach reaches bank customer files from audits as far back as 2023

Customers suing bank auditor Mercadien won a federal judge's approval to find out how far a breach the firm put at 402,741 people reaches. American Banker reported that several clients had left the firm years before their customers' files were taken, so a bank's exposure to an auditor can run past the contract.

Reality

Evidence70
Adoption
Not scored
Hype gap−10
Incentives55
Confidence65
securityConfirmed2 publishers

Android 17 copies forensic logs to Google's servers, where no one can delete them for 12 months

Google's Android 17 Intrusion Logging syncs encrypted security and network logs to its servers and bars anyone from deleting them for a rolling 12 months. The feature is a separate opt-in, so the record exists only for people who enable it before an attack.

Reality

Evidence58
Adoption
Not scored
Hype gap+10
Incentives40
Confidence60
buildOne report1 publisher

Claude Code sweeps agent transcripts older than 30 days off local disk by default

Claude Code deletes each local agent transcript once it is older than 30 days, the default for cleanupPeriodDays. Teams that keep sessions as design records need to raise the value or archive the files first, since only a backup restores a swept one.

Publishers:dev.to

Reality

Evidence55
Adoption
Not scored
Hype gap0
Incentives
Not scored
Confidence60
productConfirmed7 publishers

Flock cuts plate-read retention to seven days, and admits defaults beat policy

The licence plate reader company is making most of its new safeguards mandatory on 1 January, after its chief executive conceded that optional abuse controls sat unused at two-thirds of agencies.

Perspective Coverage

7 publishers
Builder
Builder 32%
Operator
Operator 47%
Investor
Investor 21%

Reality

Evidence70
Adoption35
Hype gap+35
Incentives70
Confidence65
securityConfirmed3 publishers

Trezor says ShipMonk kept 67,000 customer records it had certified as deleted

The records cover orders placed between November 2019 and August 2021, years past the 90-day deletion window Trezor advertises. Trezor says it held repeated written confirmation from ShipMonk that the data was gone.

Perspective Coverage

3 publishers
Builder
Builder 30%
Operator
Operator 55%
Investor
Investor 15%

Reality

Evidence62
Adoption
Not scored
Hype gap+8
Incentives64
Confidence66
buildOne report1 publisher

A 30-day retention window makes Anduril's border tower alerts unauditable

MIT Technology Review found more than 110 deaths inside the advertised range of Anduril's border towers since 2021. Tower footage is generally overwritten after 30 days, so no one can now say which stage of the alert chain failed.

Publishers:runtimewire.com

Reality

Evidence60
Adoption70
Hype gap+30
Incentives60
Confidence55
buildOne report1 publisher

Mozilla put Mistral's models behind Firefox Smart Window under zero data retention

The September 16 partnership gives Firefox's beta assistant retrieval with sources, tab grouping and history previews, and each request only sees the tabs and history you grant it. Beta coverage is the US, Canada and France.

Publishers:dev.to

Reality

Evidence38
Adoption28
Hype gap+18
Incentives58
Confidence42
securityOne report1 publisher

Xicoia face-scans every Tilly Norwood caller worldwide before the first call connects

Xicoia made a biometric age estimate mandatory for every Talking Tilly caller this month and cites legitimate interests as the legal basis. The service closes on September 27; transcripts can be held for eight weeks.

Reality

Evidence60
Adoption30
Hype gap+10
Incentives62
Confidence55
buildOne report1 publisher

A compliance agent reads its permission table and stops one transition short of signing

The EU AI Act wants AI system logs kept for six months and the GDPR wants personal data dropped when it stops being necessary. A challenge project stores the workflow that settles that gap as content both an agent and a person query.

Publishers:dev.to

Reality

Evidence62
Adoption8
Hype gap+8
Incentives70
Confidence60
buildOne report1 publisher

DPDP turns indefinite KYC retention into the risky default

India's data protection law runs alongside RBI's KYC directions with its own legal basis and its own penalties. The obligation that reaches furthest into a KYC stack is deletion that some service has to fire on a defined event.

Publishers:dev.to

Reality

Evidence30
Adoption
Not scored
Hype gap+25
Incentives70
Confidence30
buildOne report1 publisher

Flock's nationwide lookup returned Boston plate reads for three days after the city confirmed sharing was off

Boston ran about 45 Flock cameras for 156 days under a no-cost pilot. The city's surveillance report blames a Flock vendor error for three days of out-of-network access to plate data it had contracted to keep local.

Publishers:runtimewire.com

Reality

Evidence62
Adoption66
Hype gap+15
Incentives58
Confidence55
leadershipOne report1 publisher

Plaintiffs' counsel pulled a 3M expert's ChatGPT prompts into the Watson Grinding record

Plaintiffs' attorney Will Moye says he demanded the prompts behind an expert's ChatGPT-looking analysis, and the file came over the same afternoon. The record around a consequential decision now includes what people typed.

Publishers:csoonline.com

Reality

Evidence45
Adoption
Not scored
Hype gap+10
Incentives55
Confidence50
investOne report1 publisher

Krebs traces infrared license captures on a dark web market to a vendor scanning 21 million IDs a month

The infrared and ultraviolet captures a bank reads to prove a license is genuine were reportedly on sale beside the ordinary scans, which leaves the cheapest step in account opening deciding nothing on its own.

Reality

Evidence57
Adoption62
Hype gap+12
Incentives72
Confidence52