Data Retention

Overview

Data retention policies allow automatic cleanup of old submissions and events.

Retention Configuration

Form-Level Retention

Configure retention per form:

{
  "retention": {
    "days": 90,
    "policy": "delete"
  }
}

Retention Policies

• delete: Permanently delete data

• archive: Move to archive storage

Retention Processing

Scheduled Cleanup

• Runs daily at midnight (UTC)

• Lambda function processes retention

• Scans forms with retention policies

• Deletes/archives old data

Data Cleanup

Submissions:

• Deletes submissions older than retention period

• Removes from DynamoDB

• Deletes S3 objects (if stored)

Events:

• Deletes events older than retention period

• Removes from events table

Attachments:

• Deletes uploaded files

• Removes from S3 bucket

Retention Calculation

Age Calculation

Data age calculated from:

• Submission timestamp

• Event timestamp

• Creation date

Policy Application

• Checks form retention policy

• Applies to all data for that form

• Respects environment isolation

Best Practices

Retention Periods

• Development: Short retention (7-30 days)

• Production: Longer retention (90-365 days)

• Compliance: Per compliance requirements

Archive Strategy

• Use archive policy for important data

• Archive to S3 Glacier for long-term

• Maintain access to archived data

Compliance

GDPR Compliance

• Right to deletion

• Data retention limits

• Automatic cleanup

Industry Standards

• HIPAA: 6 years

• SOX: 7 years

• Custom: Configurable

Next Steps

• API Reference - Form configuration

• Dashboard Guide - Dashboard features