# Data Archival Strategy

Last updated: 2026-06-24

Migration `0027_database_integrity_readiness` creates `data_archival_policies` and seeds active policies for audit, ledger, provider reports, webhooks, sessions and notifications.

## Policy Principles

- Ledger and audit records are retained for finance, compliance, disputes and investigation needs.
- Legal holds block destructive cleanup.
- Archive exports must be encrypted and access-controlled.
- Destructive cleanup requires evidence that export completed and validation passed.
- Session and notification records can have shorter online retention when privacy policy and legal requirements allow it.

## Seeded Policy Areas

- `audit_events`: cold storage export, long retention, no delete-after-archive by default.
- `ledger_journal_entries` and `ledger_journal_lines`: finance archive, long retention.
- `sepa_provider_reports` and `sepa_provider_report_items`: provider report archive.
- `card_issuer_webhook_events`: export then delete after retention.
- `auth_sessions`: short online retention and export/delete after retention.
- `payment_notifications` and `cardholder_notifications`: customer support archive.

## Operational Flow

1. Select rows eligible by `archive_after_days`.
2. Exclude rows under legal hold or active investigation.
3. Export to the configured archive destination.
4. Validate row counts, checksums and restore readability.
5. Record evidence and operator approval.
6. Delete only when `delete_after_archive=true` and retention/legal checks pass.

## Open Production Evidence

The policy model is present in the database. Before real-money launch, schedule the first staging archive drill and attach export/restore evidence to the data-protection evidence package.