---
title: "What is a data retention policy?"
description: "A data retention policy sets how long each class of stored data is kept and what removes it. What it covers for AI agent memory, with an example schedule."
canonical: https://past.dev/glossary/data-retention
last-updated: 2026-09-02
---
# What is a data retention policy?

Source: https://past.dev/glossary/data-retention

A data retention policy states how long each class of stored data is kept and what removes it when the period ends. For AI agent memory the classes include raw ingested records, extracted facts, recall logs, and audit records, each with its own period. Retention limits exposure and cost, and several privacy regimes require stating and enforcing the periods.

## What a retention policy specifies

- **Classes**: raw source records, extracted facts, embeddings and indexes, recall logs, audit records. Each class ages differently.
- **Periods**: a duration per class, with its trigger (after collection, after contract end, after last activity).
- **Removal**: the mechanism that actually deletes the data when the period ends, including derived copies.
- **Exceptions**: legal holds and active disputes pause deletion for named records.

GDPR's storage limitation principle ([Article 5(1)(e)](https://gdpr-info.eu/art-5-gdpr/)) requires keeping personal data no longer than its purpose needs; similar duties appear in other privacy regimes.

## Why it matters for AI agents

An agent's memory keeps data indefinitely unless something removes it. Whatever was ingested remains recallable and can resurface in an answer years later, so the retention period of the memory is the retention period of the agent's knowledge.

Deletion must cover derivations. A fact extracted from an expired email outlives the email unless the policy removes facts whose only support expired. past.dev implements removal at the source level: DELETE /api/v1/ingest/{ingestionId} forgets a source and erases what only it supported.

## Data retention in practice

An example schedule for a support agent's memory, one period per class:

| Data class | Period | Trigger and removal |
| --- | --- | --- |
| Raw support emails | 24 months | Clock starts at ticket closure; source deletion cascades to unsupported facts |
| Extracted customer facts | Contract life plus 12 months | Contract end date starts the clock |
| Recall and action logs | 12 months | Rolling deletion by month |
| Audit records | 6 years | Kept longer than the data they describe, per the deployment's obligations |

The periods are illustrative; the obligation is to pick, state, and enforce them. The [AI data retention guide](/guides/ai-data-retention) treats period selection and deletion mechanics, and [GDPR memory deletion](/guides/gdpr-memory-deletion) covers erasure requests, which operate independently of scheduled retention.

## Related concepts

- **[Audit trail](/glossary/audit-trail)**: records that often outlive the data they describe.
- **[Memory decay](/glossary/memory-decay)**: ranking demotion; retention is actual removal.
- **[Data provenance](/glossary/data-provenance)**: knowing what each source supports, which correct deletion requires.
- **[Memory staleness](/glossary/memory-staleness)**: outdated values, a separate problem from expired ones.
- **[Cross-session memory](/glossary/cross-session-memory)**: the persistence that makes retention rules necessary.

## Frequently asked questions

### How long should an AI agent retain memory?

There is no single period. Set one per data class based on purpose, contract terms, and the privacy rules that apply to the deployment, then enforce it with actual deletion. Raw sources, extracted facts, and audit logs usually get different periods.

### Does deleting a source delete the facts extracted from it?

Only if the system tracks which sources support which facts and cascades the deletion. Without that link, extracted facts survive their expired sources and the policy is enforced in name only.

### What is the difference between data retention and memory decay?

Retention removes data when a stated period ends. Decay is a retrieval policy that ranks older memory lower while keeping it stored. Decayed data still exists and must still be covered by retention.

## Related

- [Audit trail](https://past.dev/glossary/audit-trail)
- [Data provenance](https://past.dev/glossary/data-provenance)
- [AI data retention guide](https://past.dev/guides/ai-data-retention)
- [Memory API quickstart](https://past.dev/docs/memory-api/quickstart)
- [Benchmark methodology](https://past.dev/benchmarks/methodology)