Skip to main content
Forge separates sensitive AI evidence from the durable security records needed to investigate activity, explain decisions, and prove administrative changes. Organization-wide retention settings control the lifecycle of both classes without treating all data as equivalent.

​
Data classes

Evidence records also carry source-level visibility and privacy state. A metadata-only source can prove that activity occurred but cannot prove the content of that activity. Forge preserves that distinction instead of presenting missing content as inspected evidence. Content policies can minimize data inline by redacting prompt, tool input, tool result, or response fields at supported enforcement points. See Redaction for the transformation contract.

​
Retention

Retention is configured for the entire organization. The Console displays both the selected value and its effective days. The effective period can be longer when Forge applies a minimum retention floor to a durable record class. Changing a setting creates a new settings version and an audit event. Members with audit-view permission can read the settings and cleanup state; organization managers can change the windows or manage a hold.

​
Cleanup

The retention worker runs on the deployment’s configured schedule. Each job records:
  • The settings version and evidence/security cutoffs it used.
  • Detail and record deletion counts.
  • Tombstones written for expired evidence.
  • Records skipped because of a preservation hold.
  • Partial or complete failures.
Evidence-detail cleanup removes expired content and embeddings and replaces retained body references with an expired-detail marker. Forge keeps the classified metadata and metrics belonging to any still-retained security record. Cleanup covers Forge-managed PostgreSQL and ClickHouse records and configured retained-body storage. Non-authoritative transport copies are bounded separately and are not treated as the durable evidence record. If an external retained body cannot be deleted, Forge keeps the reference retryable and marks the job partially failed or failed. It does not record a successful deletion merely because a database reference was cleared.

​
Tombstone proofs

For covered records, Forge can resolve a tombstone proof by target type and ID. The proof identifies the retention job, bucket, source, decision, and expiration time that explain why detail is no longer available.

​
Preservation holds

A preservation hold pauses automatic retention cleanup for the organization. Activating and releasing a hold both require a reason and create audit events. An active hold protects authoritative Forge-managed records and retained bodies. It does not extend the lifecycle of a non-authoritative transport duplicate.

​
Exports

Forge retention applies only to copies controlled by Forge. Once evidence is delivered to a customer-managed destination such as Splunk or Amazon S3, that destination’s access controls and retention policy govern the exported copy. Expiring the Forge copy does not delete data from the destination. Configure export detail deliberately: a destination can retain content longer than Forge even when the original evidence later shows an expired-detail marker.

Audit Log

Review retention changes, holds, and cleanup integrity.

Compliance

Connect retained security evidence to framework controls.

Splunk

Export security telemetry to a customer-managed destination.

Amazon S3

Store exported evidence in customer-controlled object storage.