> ## Documentation Index > Fetch the complete documentation index at: https://docs.forge.ai/llms.txt > Use this file to discover all available pages before exploring further. # Privacy > Control sensitive evidence retention, cleanup, preservation holds, and exported copies. Forge separates sensitive AI evidence from the durable security records needed to investigate activity, explain decisions, and prove administrative changes. Organization-wide retention settings control the lifecycle of both classes without treating all data as equivalent. ## Data classes | Class | Includes | | ---------------- | ------------------------------------------------------------------------------------------------------------------ | | Evidence detail | Raw prompt, response, tool, provider payload, manual evidence detail, embeddings, and retained body references. | | Security records | Audit events, compliance snapshots, workflow state, export delivery records, policy evidence, and deletion proofs. | Evidence records also carry source-level visibility and privacy state. A metadata-only source can prove that activity occurred but cannot prove the content of that activity. Forge preserves that distinction instead of presenting missing content as inspected evidence. Content policies can minimize data inline by redacting prompt, tool input, tool result, or response fields at supported enforcement points. See [Redaction](/secure/redaction) for the transformation contract. ## Retention Retention is configured for the entire organization. | Setting | Values | Default | | ---------------- | ------------------------ | ------- | | Evidence detail | 30, 90, 180, or 365 days | 90 days | | Security records | 1, 3, or 7 years | 3 years | The Console displays both the selected value and its **effective days**. The effective period can be longer when Forge applies a minimum retention floor to a durable record class. Changing a setting creates a new settings version and an audit event. Members with audit-view permission can read the settings and cleanup state; organization managers can change the windows or manage a hold. ## Cleanup The retention worker runs on the deployment's configured schedule. Each job records: * The settings version and evidence/security cutoffs it used. * Detail and record deletion counts. * Tombstones written for expired evidence. * Records skipped because of a preservation hold. * Partial or complete failures. Evidence-detail cleanup removes expired content and embeddings and replaces retained body references with an expired-detail marker. Forge keeps the classified metadata and metrics belonging to any still-retained security record. Cleanup covers Forge-managed PostgreSQL and ClickHouse records and configured retained-body storage. Non-authoritative transport copies are bounded separately and are not treated as the durable evidence record. If an external retained body cannot be deleted, Forge keeps the reference retryable and marks the job partially failed or failed. It does not record a successful deletion merely because a database reference was cleared. ### Tombstone proofs For covered records, Forge can resolve a tombstone proof by target type and ID. The proof identifies the retention job, bucket, source, decision, and expiration time that explain why detail is no longer available. ## Preservation holds A preservation hold pauses automatic retention cleanup for the organization. Activating and releasing a hold both require a reason and create audit events. | State | Meaning | | ---------- | -------------------------------------------------------------------------------- | | `pending` | A cleanup job is already running. New cleanup is paused while that run finishes. | | `active` | Automatic cleanup is paused. | | `released` | Cleanup may resume on the normal schedule. | An active hold protects authoritative Forge-managed records and retained bodies. It does not extend the lifecycle of a non-authoritative transport duplicate. ## Exports Forge retention applies only to copies controlled by Forge. Once evidence is delivered to a customer-managed destination such as Splunk or Amazon S3, that destination's access controls and retention policy govern the exported copy. Expiring the Forge copy does not delete data from the destination. Configure export detail deliberately: a destination can retain content longer than Forge even when the original evidence later shows an expired-detail marker. ## Related pages Review retention changes, holds, and cleanup integrity. Connect retained security evidence to framework controls. Export security telemetry to a customer-managed destination. Store exported evidence in customer-controlled object storage.