DATA RETENTION POLICY UPDATE (V1.1)

Policy ID: DRP-1.1 Effective Date: 2025-12-15 Supersedes: DRP-1.0 (2025-05-01)

1. OBJECTIVE To enforce a principle of data minimization, ensuring all data collected by Covenant infrastructure is retained only for the minimum period necessary for operational integrity, auditing, and compliance.  
2. KEY CHANGES (V1.1)  
* Audit Logs: Retention period is reduced from 10 years to 5 years. Exceptions require TSC approval.  
* Operational Telemetry: Retention period is reduced from 1 year to 6 months on hot storage. Data is then archived to cold storage for a total of 2 years.  
* Personally Identifiable Information (PII): If PII is collected (rare), it must be pseudonymized or deleted within 90 days of the originating transaction being completed.  
3. COMPLIANCE All platform administrators are required to implement and verify automated deletion schedules matching these revised periods.

