Data Retention and Deletion

Team owners can choose operation-runtime retention from 24 to 720 hours; the default is 72 hours. Individual artifact expiry can be shorter. Billing, credit, policy, audit, security, and legal-hold records follow their own retention rules and are not erased merely because result content expires.

Artifact availability is explicit:

• available: metadata and download access can be used until expiry.
• deleting: access returns artifact_deletion_in_progress (HTTP 409); retry after the response delay.
• deletion_failed: access returns artifact_deletion_failed (HTTP 503); contact support with the public artifact reference.
• expired or deleted: access returns artifact_expired and does not reveal storage details.

Security controls

Unsafe targets are rejected as target_fetch_blocked. Chab validates redirects and destination addresses before outbound requests. Sensitive text operations may return secret_content_detected; remove credentials and submit safe content. If the required scanner is unavailable, secret_scan_unavailable fails closed without billing. Active security restrictions use security_restriction_active with a safe remediation link.

Deletion proceeds through revocation, content cleanup, and handling of records that must be kept. A legal or security hold can delay otherwise eligible deletion. Chab does not expose internal storage names, scanner rules, provider details, or investigation notes.

Project connections retain only provider-neutral link facts, a customer-written alias, normalized health/sync state, exact capability observations, and an encrypted reference to family-owned credentials. A project soft deletion makes its connections unusable. Team or applicable account erasure blocks connection effects, destroys credential and authorization-secret references, removes authorization attempts, then removes connection and capability rows before deleting project data. Authorization attempts initiated by an erased user are also destroyed even when the surrounding shared team is retained.

Redirect authorization attempts expire after 10 minutes. Terminal and replay tombstones are retained for no more than 24 hours after their authorization secrets are destroyed. If a family secret store is temporarily unavailable, Chab keeps only the encrypted deletion handle, retries destruction, and does not delete the tombstone until the handle is removed. Raw opaque state, provider authorization codes, callback bodies, and credentials are not privacy exports. Recovery-required attempts retain only the minimum encrypted recovery reference within the same hard limit. Customer exports include safe connection metadata and aliases, but not logical-source fingerprints, provider resource identifiers, credential references, attempt state hashes, or authorization secrets.