Oktra Data Retention and Disposal Policy
Last updated 2026-07-06
Organization: Oktra (oktra.ai)
Published at: https://oktra.ai/legal/data-retention
Parent policy: documentation/security/information-security-policy.md §5 (Data protection)
Owner: Managing Director (operator)
Effective: 2026-07-06 · Review: annually with the parent policy, and on any change to data classes processed
Version: 1.0 (final, operator-ratified 2026-07-06)
1. Principle
Oktra retains personal and financial data only as long as it is needed to provide the service or to meet a legal obligation, and disposes of it by defined, verifiable means. The customer's accounting platform remains the system of record (ISP §10); Oktra can re-derive its working state, so retention here is deliberately short.
2. Data classes and retention periods
| Data class | Where held | Retained | Disposal trigger |
|---|---|---|---|
| Connection credentials (OAuth tokens, API keys) | Per-connection managed key vault (currently Azure Key Vault) | While the connection is active | Disconnection or offboarding: token revoked at the provider AND the connection's vault purged, in that order (ISP §4) |
| Financial data retrieved via connected providers (transactions, balances, account metadata) | Production database | While the customer account is active | Erased within 30 days of customer offboarding or verified erasure request |
| Connection directory and metadata (tenant→connection binding, company names, external identifiers) | Production database | While the customer account is active | Erased with the customer account (same window as above) |
| Customer account data (users, settings) | Production database | While the customer account is active | Erased on offboarding, subject to §3 legal holds |
| Audit records of writes to customer financial systems | Append-only audit store | 7 years (statutory financial-records window, §3) | Aged out on schedule; retained independently of customer offboarding |
| Security/operational logs (vault access, sign-in, service logs) | Platform log stores | Per platform diagnostic retention settings, reviewed annually | Aged out automatically; contain no secrets by design (ISP §4) |
| Backups | Platform backup schedules; Acronis image backups (on-prem) | Backup retention window only | Deleted data ages out of backups with the backup cycle; backups are not a retrieval path for erased customer data |
3. Legal holds and obligations
Where a statutory obligation requires retention beyond the table above, the specific records are retained for the statutory period and erased when it lapses. The 7-year audit-record window is anchored on financial-records obligations in both operating regions (EU bookkeeping-retention law and US tax record-keeping guidance). A legal hold suspends disposal for affected records only and is recorded as a ticket with its lifting condition.
4. Disposal methods
- Secrets: vault purge (soft-delete window then permanent destruction per vault configuration); provider-side revocation always precedes local purge so no live grant is ever unrecorded.
- Database records: hard deletion of the customer's rows (the schema uses no soft-delete columns; deletion is deletion).
- Backups: no selective backup editing - erased data leaves backups by aging out of the retention cycle; restores after an erasure re-apply pending erasures before service resumes.
- Hardware: decommissioned disks/workstations are wiped or physically destroyed before disposal.
5. Data subject and consumer requests (all jurisdictions)
One process for everyone: verified erasure requests are honored within the 30-day window of §2 regardless of the requester's residency - account data, financial data, metadata, and connection secrets are disposed of per §4, and completion is recorded as a ticket. Audit records and legally-held records are excluded per §3 and the requester is informed of the exclusion and its basis.
Jurisdictional mapping (the same process satisfies each regime):
- EU/EEA/UK (GDPR / UK GDPR): the 30-day window meets the one-month response deadline for erasure and access requests (Art. 12/17); the lawful bases and disclosures are stated in the customer-facing privacy policy.
- United States (state privacy laws, e.g. CCPA/CPRA): the 30-day window is inside the 45-day response deadline; consumer deletion and access rights are honored through the identical process.
- Other jurisdictions: the same process applies as a matter of policy.
6. Enforcement and review
- Disconnection/offboarding disposal (revoke + purge ordering) is a designed-in, tested capability of every connector (ISP §9).
- This policy is reviewed annually with the parent policy, and its application is
spot-checked in the quarterly access review (orphan-vault check,
quarterly-access-review-checklist.md§A). - Retention statements in the customer-facing privacy policy mirror this policy; any change here propagates to the published privacy policy in the same change.
- Exceptions require a recorded ruling by the Managing Director with rationale and expiry (ISP §12).