# Data retention

Gateman keeps only the operational history needed to provide a supported
capability, protect against unsafe replay, recover an accepted operation, or
maintain an accounting and ownership record. Retention is enforced by
application-owned cleanup paths. It does not change host log rotation,
infrastructure backups, Cloudflare retention, provider retention, or a
customer application's own storage.

## Retention schedule

| Record class | Retention and cleanup rule |
| --- | --- |
| Password-reset tokens and passkey challenges | Delete after expiry plus a 24-hour cleanup grace period. |
| Email and SMS idempotency results | Definite terminal results are replayable for 15 minutes, then are physically reclaimed in bounded batches. |
| Uncertain send claims | Email `unknown`, SMS `indeterminate`, provider-started claims, and unresolved in-progress claims remain protected from unsafe duplicate execution. |
| Staging/development email captures | Delete after 7 days through the mailbox-capture cleanup path. |
| Staging/development SMS captures | Delete after 7 days. |
| Gateman application diagnostics | Application-owned structured logs are retained for 7 days. Sensitive values and provider payloads are not logged. |
| Provider operational history | Email events, production SES/Postmark/Resend message metadata, and non-processing billing event records are retained for 31 days. Derived daily email activity summaries are retained for 60 days. Active processing claims are preserved. |
| Derived provider access-token cache | Delete after provider expiry plus a five-minute safety margin. The cache is current state, not token history. |
| Credential-request claims | Retain for the complete 11-minute authentication replay window, then delete. Claims contain no credential value. |
| Superseded provider setup metadata | Retain superseded SES setup metadata for 90 days to support reconciliation and safe cleanup, then delete. |
| Temporary setup credentials | Delete after their explicit expiry and retain the provider-revocation state needed to complete cleanup. Deleting Gateman's copy is not provider-side revocation. |

Cleanup is repeatable and bounded. The short-lived operational-record
housekeeping path processes at most 100 rows per record class per run, so a
backlog drains across later runs without making one large destructive delete.
Cleanup predicates exclude active or uncertain work and are safe to race with
normal claim, completion, refresh, and recovery operations.

## Records that are not automatically expired

Global hard-bounce suppression remains active until an explicit supported
administrative action changes it. Application-scoped complaint suppression
also remains active; the 31-day event-history cleanup does not remove
suppression state. Active provider credentials and current provider
configuration remain for their active application lifetime and are governed by
their retrieval controls, not by the operational-history window.

Application deletion follows Gateman's permanent application identity and
ownership rules. App-scoped operational data is removed with the application
where the database relationship permits it; application identity is not
silently reused, and accounting history is not rewritten to make deletion
appear as if an operation never occurred. Customer-managed provider resources
are not deleted merely because Gateman's stored metadata expires.

Stripe billing and payment records use their own billing cleanup and provider
state rules. WordPress diagnostic retention remains configurable by the
WordPress installation. Neither is shortened by this schedule.

## What an application should expect

Do not use Gateman's retained email or SMS history as a permanent message
archive. Do not assume that a repeated request is safe after an idempotency
record expires; create a new key only when the original outcome is known not
to have executed, or when the application deliberately accepts duplicate
execution risk. Applications that need longer audit, message, or provider
history must retain that information in their own systems or use the relevant
provider's facilities.

Gateman cleanup does not call email, SMS, payment, or cloud-provider APIs to
delete provider resources. It removes only the bounded Gateman records listed
above and performs no host-log or backup deletion.