Compliance
Retention policy, explained
Retention is where two legal pressures meet head-on. Data protection law says personal data must not be kept longer than the purpose requires, which argues for deleting early. Commercial, tax and sector law require certain records to be kept for years — in Germany, the periods in § 257 HGB and § 147 AO — which argues for keeping. A retention policy is the written resolution of that conflict, per category of data.
How Enclessa uses it
Enclessa supports retention per organisation, and the default keeps data rather than deleting it, so nothing disappears because a setting was never visited. A team and a room can each set a shorter period; the shortest of the organisation’s, the team’s and the room’s applies, and files held for a legal duty are never deleted by it. In an end-to-end encrypted room this deletes only the server’s copy of the ciphertext, not what members’ devices hold. The People module carries its own retention metadata on custom fields, and organisation deletion runs as a resumable purge that derives its scope from the schema rather than from a hand-written list.