Data Retention & Disposal Policy

Purpose

This policy defines retention periods for different types of data and procedures for secure disposal when data is no longer needed.

Scope note: Maelstrom AI operates two platforms under one ISMS — Provii (zero knowledge age verification) and downpipes (no-custody backup & disaster recovery for the Cloudflare data layer). Data retention and disposal is a cross-cutting control. The bulk of this policy governs the Provii-operated services, where the zero knowledge architecture means no end-user PII is persisted server-side. downpipes is no-custody: the engine and console run in the customer’s own Cloudflare account, under the customer’s keys, so Maelstrom holds no customer keys, data or Cloudflare tokens and therefore retains, deletes and erases no customer data on the vendor side. Retention and disposal of customer backup archives are determined by the customer, who owns both the destinations and the keys. Where downpipes retention applies, it is called out explicitly below.

Retention Principles

Minimisation: Collect and retain only necessary data Purpose Limitation: Retain data only for its intended purpose Transparency: Retention periods publicly documented Security: Data protected throughout its lifecycle Disposal: Secure deletion when no longer needed

Retention Periods

Operational Data

Tiered retention: Standard audit log entries are retained for 90 days. Critical security events (such as detected attacks, replay attempts, and IP blocks) are retained for up to 365 days to support security investigation.

Docs Interactive Sandbox Data

The docs interactive sandbox introduced in Phase 0A maintains its own KV state under TTLs that are stricter than the production audit ceiling. The TTLs are enforced both client-side (cookie expiry) and server-side (Cloudflare KV TTL) and are documented here for transparency. Enforcement is in provii-agegate/src/docs/session.ts and the surrounding gateway handler modules.

Source-code reference: provii-agegate/src/docs/session.ts is the canonical TTL definition for the session and credential entries. The mobile install TTL is defined in the mobile gateway handler under the mwallet-sbx-* write path.

Cross-references: Docs Sandbox DPIA Section 1 (Data Processed) and Section 2 (Storage Limitation); DPA Docs Sandbox Addendum Section 3.5; ROPA Activities 2.5 and 2.6; Statement of Applicability ISO 27701:2019 A.7.4.5 and A.7.4.7 entries.

Development Data

Business Records

downpipes Backup Archives

Maelstrom’s entire Cloudflare estate is backed up by our own production instance of downpipes — we run downpipes as a customer of our own product. Backup archives are sealed with post-quantum hybrid encryption under operator-held keys and fanned out 3-2-1 to Maelstrom-controlled destinations; archive retention is applied on a customer-set schedule by the in-tenant engine. Because downpipes is no-custody, this generates no second custodian and no server-side PII — the archives contain only Maelstrom’s own operational Cloudflare data, readable only with the operator-held keys.

For the downpipes product, retention and disposal of backup archives are determined by the customer, who owns both the destinations and the keys; Maelstrom holds no customer keys, data or Cloudflare tokens and so retains and deletes nothing on the customer’s behalf. See the Cloudflare Backup Evidence for Maelstrom’s self-hosted instance.

What We DON’T Collect

Zero knowledge architecture means the Provii-operated services never persist to at-rest storage:

• Names, addresses, contact information
• Raw dates of birth
• Identity document data
• Biometric information
• Any other personally identifiable information (PII)

During credential issuance, the date of birth is transmitted once to the issuer API for Pedersen commitment computation. The DOB is processed ephemerally and immediately discarded. It is never written to persistent storage, databases, or audit logs. During age verification, no date of birth is transmitted; only a zero knowledge proof is presented to the verifier.

For downpipes, the no-custody architecture means Maelstrom never receives customer data in the first place: the engine and console run in the customer’s own Cloudflare account, under the customer’s keys, and the vendor-side control-plane holds no customer keys, data or Cloudflare tokens. There is therefore no customer-data retention or disposal obligation on the vendor side.

Therefore:

• No server-side PII retention policy needed (DOB is processed transiently during issuance and not written to persistent storage; downpipes is no-custody and Maelstrom holds no customer data on the vendor side)
• No server-side PII disposal procedures needed (no PII stored to dispose)
• Significantly simplified compliance obligations

Disposal Procedures

Digital Data

Cloudflare KV:

// Automated deletion after retention period
await env.AUDIT_LOG.delete(key);

Ephemeral Data (KV TTL-based expiry for challenges and nonces):

• Auto-expires based on TTL (5 minutes provii-verifier, 2 minutes provii-issuer)
• No manual deletion needed
• Garbage collection automatic

Source Code / Git:

• Git history: Retained indefinitely (immutable by design)
• Sensitive data accidentally committed: Rewrite history + rotate secrets
• Repository deletion: Only with ISMS Owner approval

Cryptographic Material

Signing Keys:

• Retention: Until rotated + grace period (keys transition Active → Deprecated → Disabled)
• Disposal: In-memory key material zeroised on Drop; persistent encrypted material in KV deleted by administrator or rendered inaccessible via KEK rotation
• Offline backups: Physical destruction (shred or degauss)

Secrets (API keys, HMAC secrets):

• Retention: Until rotated
• Disposal: Delete from KV/secrets manager
• Never in source code (so can’t be “deleted” from Git history)

downpipes vendor-side keys:

• downpipes Licence Signer: held in Cloudflare Secrets Store (control-plane); disposed by deletion from Secrets Store on rotation. Fail-open, so disposal never gates customer backup or restore.
• downpipes Update Signer: held offline by the operator and never deployed to any Worker; disposed by physical destruction of the offline media (shred or degauss).
• Customer archive, break-glass and operational keys are customer-generated and customer-held (no-custody); their retention and disposal are a complementary user-entity control owned by the customer, and Maelstrom holds no copy to dispose of.

Physical Media

Devices (laptops, hard drives):

• Full disk encryption: Delete encryption keys (cryptographic erasure)
• Additional: Secure wipe (multiple passes) or physical destruction
• Company devices: Documented disposal in asset register
• Personal devices (BYOD): Individual responsibility (guidance provided)

Paper Documents (rare):

• Shredding (cross-cut shredder minimum)
• Sensitive documents: Witnessed destruction

Automated Deletion

Implementation

Audit Logs (Cloudflare Workers Logs in Grafana Loki + KV):

// Workers Logs are shipped to Grafana Loki at emit time
// Loki tenant retention: 90 days, applied automatically
// No manual cleanup needed

Audit Logs (KV):

// Per-entry TTLs with 90-day retention
// Automated cleanup via KV expiration
// Retention period aligned across all services (provii-verifier including hosted mode, provii-issuer)

Challenges and Nonces (KV with TTL):

// TTL-based expiration (provii-verifier: 300s, provii-issuer: 120s)
// Automatic cleanup via Cloudflare KV expiration

Legal Holds

If legal proceedings require data retention:

1. Legal counsel notifies ISMS Owner
2. Relevant data identified
3. Automated deletion suspended for specific data
4. Data preserved until hold lifted
5. Normal disposal resumes after hold

Currently: No legal holds in effect

Data Subject Requests

Context: For Provii, the zero knowledge architecture means we rarely have personal data. For downpipes, the no-custody architecture means Maelstrom holds no customer data on the vendor side at all, so there is nothing held vendor-side to access, delete or rectify.

If we receive a request:

• Access request. Confirm we have no PII about requestor
• Deletion request. Confirm no PII to delete (IP logs deleted after 90 days automatically)
• Rectification request. Not applicable (no PII stored)

Response time: Within 30 days (Australian Privacy Act requirement)

Disposal Verification

For sensitive data disposal:

• Document what was disposed
• Method used
• Date of disposal
• Person responsible
• Verification (where applicable)

Asset Register: Updated to reflect disposed assets

Related Documents

1. Asset Management Procedure
2. Information Security Policy
3. Statement of Applicability - Control A.8.10 (Information Deletion)
4. Cloudflare Backup Evidence - Maelstrom’s self-hosted downpipes backup and recovery record

Document Information

• Version. 1.3
• Effective Date. 2025-01-13
• Last Updated. 2026-06-19 (downpipes added as second in-scope platform; the legacy backup worker retired in favour of self-hosted downpipes)
• Owner. ISMS Owner
• Review Frequency. Annually
• Next Review. 2027-04-13
• Classification. Public