DemoLog inContactDE
Data Retention & Lifecycle Governance

Retention as a hardened state machine — not a storage setting.

Three strict tiers. Public labs leave nothing on a server. Workspace data lives in encrypted, per-org partitions with configurable lifecycle. Compliance records are WORM, blocked from UPDATE and DELETE for everyone — including us.

See the 3-tier modelBook a demo

Why retention is a legal battleground, not a setting

In the DACH region and the wider European enterprise market, data retention is the ground floor of GDPR, NIS2 and GoBD compliance. Most SaaS tools dump files into a cloud bucket and forget them. Lojycal partitions every byte across three strict tiers, each with its own physics — and each provable to an auditor.

The 3-tier data retention architecture

┌─────────────────────────────────────────────────────────────────────────┐
│                      LOJYCAL DATA RETENTION MACHINE                     │
└─────────────────────────────────────────────────────────────────────────┘
                                     │
         ┌───────────────────────────┼───────────────────────────┐
         ▼                           ▼                           ▼
[ 1. PUBLIC EPHEMERAL TIER ]  [ 2. WORKSPACE ACTIVE TIER ] [ 3. WORM COMPLIANCE LEDGER ]
 - Browser Memory Only         - Encryption-at-Rest         - Read-Only Storage
 - No Server Persistence       - Configurable Lifecycle     - Strict Statutory Timelines
 - In-Memory Purge on Verdict  - Per-Org RLS Partitions     - Updates/Deletes Hard-Blocked
Tier 1 · Public Ephemeral
No server-side persistence

Public unauthenticated tools — the AI Spreadsheet Analyzer, the anonymous Contract Review Lab — parse files entirely in browser memory. The raw rows are never written to a Lojycal database. When the verdict renders, in-memory buffers are released and only aggregate counts remain on screen.

  • • AI Subscription Analyzer: CSV / XLSX parsed in-browser; raw rows purged the moment the verdict renders.
  • • Anonymous Contract Review Lab: contract text held in client state only.
  • • No row is inserted into a Lojycal table without an authenticated org context.
Tier 2 · Workspace Active
Encrypted at rest · partitioned by org · configurable lifecycle

Inside the authenticated workspace, customer data is stored in managed Postgres with encryption at rest provided by the platform. Every tenant table is partitioned by organization_id and gated by per-org RLS (is_org_member / has_org_role), with AAL2 enforced where the org sets force_mfa. Where retention is implemented (e.g. cookie jar events, automation runs, MDM telemetry), admins can configure lifecycle windows and scheduled cron jobs execute the deletion cascade.

  • • Per-org RLS on every customer table — no cross-tenant reads.
  • • AAL2 gate enforced via has_required_mfa_for_org when force_mfa is set in org_settings.preferences.
  • • Secret columns (tokens, recovery codes, vendor credentials) are REVOKE-protected at the privilege layer, not just RLS.
  • • Scheduled cron jobs (e.g. break-glass-expire-tick, siem-tick) drive lifecycle transitions on a fixed cadence.
Tier 3 · WORM Compliance Ledger
Write-once · UPDATE and DELETE hard-blocked

Finalised compliance actions, asset termination records and financial cost-containment events commit to write-once-read-many tables protected by the worm_block_mutation trigger. UPDATE and DELETE are blocked for everyone — including platform admins. When an auditor asks for evidence, the record is cryptographically pristine and un-falsifiable.

  • • incident_archive · incident_reports — incident pack, immutable.
  • • mdm_dispatch_failures — every failed MDM write, vendor evidence intact.
  • • vendor_order_dispatches — procurement settlement trail.
  • • audit_log · evidence_pack_signatures · jira_impact_assessments — all WORM.
  • • Evidence packs signed with per-org HMAC keys (evidence_pack_signing_keys) — non-repudiable on export.

Aligned with GDPR, NIS2 and GoBD evidence requirements

Lojycal is designed to support the evidence and retention obligations that European mid-market and enterprise buyers operate under. The platform is not a substitute for legal counsel — retention windows for regulated records remain the customer's responsibility — but the architecture is built so an auditor's questions have a machine answer, not a policy PDF.

  • GDPR: per-org partitioning, configurable lifecycle, deletion cascade on retention expiry where implemented.
  • NIS2: WORM incident archive, signed evidence packs, audit_log for every privileged action.
  • GoBD: immutable financial and compliance settlement trails in WORM tables, blocked from UPDATE / DELETE.
  • Evidence packs: per-org HMAC signing keys, every export logged to evidence_pack_signatures.
  • Access reviews and break-glass: dual-control, segregation of duties, auto-expiring sessions.
  • Secret hygiene at the privilege layer (REVOKE), not just RLS — clients cannot read tokens or recovery codes.

Disclaimer: Lojycal does not provide legal advice. Customers retain responsibility for determining the statutory retention windows that apply to their records and for configuring workspace lifecycle controls accordingly.

Governance on by default

  • Public labs: no server-side persistence, in-memory purge on verdict.
  • Workspace tables: per-org RLS, AAL2 where force_mfa is set, AES-class encryption at rest via the managed cloud platform.
  • PII surfaced only through *_safe views — plaintext columns are REVOKE-protected from authenticated.
  • WORM compliance tables: worm_block_mutation trigger rejects UPDATE / DELETE for everyone.
  • Evidence packs signed with per-org HMAC keys; export is non-repudiable.
  • Tenant isolation tested nightly (isolation-test-nightly 03:00 UTC) with results written to a WORM run table.

Retention you can prove. Not retention you hope holds.

Three tiers, three sets of physics. Public data leaves no trace, workspace data lives on a leash you control, and compliance records are immutable for everyone — us included.

Book a demoTrust CenterSee pricingSee Risk Frameworks