Retention and deletion
Active workspace data
Operational records remain under the participating institution's control during the pilot. Records are archived by default rather than immediately erased.
Course-catalog sources
An archived catalog source is removed from active discovery and public sharing but remains recoverable for 30 days with its import evidence and review history intact. During that period a workspace member may restore it. After the deadline, an institution owner may permanently remove the source and its retained private file revisions through an audited action.
Workspace deletion
An owner starts deletion, waits at least 24 hours, and confirms separately. Confirmation moves the workspace into a 30-day recovery window. An owner may cancel during that window. Permanent purge is an operator-run, audited step after the recovery deadline.
Applications and pilot end
Rejected or abandoned applications and pilot-end workspaces follow the periods agreed in the pilot contract. Exact legal periods remain subject to review before customer onboarding; they must be recorded in the operational register rather than inferred by the product.
Separate records
Security, audit, delivery, and minimal analytics records may follow separate documented periods where needed for security, legal claims, or service integrity. Audit records are immutable and avoid duplicating sensitive record content.