Retention & Erasure Runbook (Draft)

Store	What	Retention	Erase procedure
Client IndexedDB	Encrypted evidence blobs	User-controlled	App “delete evidence” / clear site data
Client memory	Raw OCR/PDF text	Request lifetime	GC; never egress
Redis / memory	jti, rate-limit, SSE tickets	~1h / TTL	Key TTL; DEL by prefix on incident
Postgres alerts (B3+)	Encrypted indicators + signed blob	90 days default	Delete row (DEK dies) + purge mule_key from corroboration
Postgres triage_quarantine	Anonymous / WhatsApp public-triage indicators (source_tier: public_triage)	30 days default	Delete row (DEK dies) + purge quarantine indexes; never written to corroboration / outbox (ADV-005)
Postgres processed_events	Idempotency ledger	Align to stream retention	Purge where retention_expires_at < now()
Application logs	Structured events	90 days (ops target)	Log rotate / object-store lifecycle

Backup bound: PITR/WAL retention must be ≤ product retention or erasure SLAs are violated.

Pilot note: B6 implements the daily purge job; B0 only ships columns + design.