Data retention
Gateman keeps only the operational history needed to provide a supported capability, protect against unsafe replay, recover an accepted operation, or maintain an accounting and ownership record. Retention is enforced by application-owned cleanup paths. It does not change host log rotation, infrastructure backups, Cloudflare retention, provider retention, or a customer application's own storage.
Retention schedule
| Record class | Retention and cleanup rule |
|---|---|
| Password-reset tokens and passkey challenges | Delete after expiry plus a 24-hour cleanup grace period. |
| Email and SMS idempotency results | Definite terminal results are replayable for 15 minutes, then are physically reclaimed in bounded batches. |
| Uncertain send claims | Email unknown, SMS indeterminate, provider-started claims, and unresolved in-progress claims remain protected from unsafe duplicate execution. |
| Staging/development email captures | Delete after 7 days through the mailbox-capture cleanup path. |
| Staging/development SMS captures | Delete after 7 days. |
| Gateman application diagnostics | Application-owned structured logs are retained for 7 days. Sensitive values and provider payloads are not logged. |
| Provider operational history | Email events, production SES/Postmark/Resend message metadata, and non-processing billing event records are retained for 31 days. Derived daily email activity summaries are retained for 60 days. Active processing claims are preserved. |
| Derived provider access-token cache | Delete after provider expiry plus a five-minute safety margin. The cache is current state, not token history. |
| Credential-request claims | Retain for the complete 11-minute authentication replay window, then delete. Claims contain no credential value. |
| Superseded provider setup metadata | Retain superseded SES setup metadata for 90 days to support reconciliation and safe cleanup, then delete. |
| Temporary setup credentials | Delete after their explicit expiry and retain the provider-revocation state needed to complete cleanup. Deleting Gateman's copy is not provider-side revocation. |
Cleanup is repeatable and bounded. The short-lived operational-record housekeeping path processes at most 100 rows per record class per run, so a backlog drains across later runs without making one large destructive delete. Cleanup predicates exclude active or uncertain work and are safe to race with normal claim, completion, refresh, and recovery operations.
Records that are not automatically expired
Global hard-bounce suppression remains active until an explicit supported administrative action changes it. Application-scoped complaint suppression also remains active; the 31-day event-history cleanup does not remove suppression state. Active provider credentials and current provider configuration remain for their active application lifetime and are governed by their retrieval controls, not by the operational-history window.
Application deletion follows Gateman's permanent application identity and ownership rules. App-scoped operational data is removed with the application where the database relationship permits it; application identity is not silently reused, and accounting history is not rewritten to make deletion appear as if an operation never occurred. Customer-managed provider resources are not deleted merely because Gateman's stored metadata expires.
Stripe billing and payment records use their own billing cleanup and provider state rules. WordPress diagnostic retention remains configurable by the WordPress installation. Neither is shortened by this schedule.
What an application should expect
Do not use Gateman's retained email or SMS history as a permanent message archive. Do not assume that a repeated request is safe after an idempotency record expires; create a new key only when the original outcome is known not to have executed, or when the application deliberately accepts duplicate execution risk. Applications that need longer audit, message, or provider history must retain that information in their own systems or use the relevant provider's facilities.
Gateman cleanup does not call email, SMS, payment, or cloud-provider APIs to delete provider resources. It removes only the bounded Gateman records listed above and performs no host-log or backup deletion.