Data retention
This page lists what a self-hosted instance stores, where, and for how long. Each period comes from the code or the shipped configuration. "No automatic deletion" means that no scheduled job deletes the data. The Deleted by column then names what still removes it. The personal-data map describes workspace purge, disconnection, and verified person erasure. The operator's record of processing gives the legal basis of each category.
The Setting column names the environment variable when the supported stack forwards it from .env.
Otherwise, it names the Spring property, and the value is fixed in the supported stack.
The configuration reference lists the settings that have an environment variable.
The times of the scheduled jobs are in the time zone of the server process.
Worker disk
The worker keeps these files under /data/worker-git-repos, on the worker-git-repos volume.
| Data | Retention | Setting | Deleted by |
|---|---|---|---|
| Debug transcript of an agent run | 24 hours. It goes earlier when the job's evidence expires. | None | A worker sweep every minute |
| Inputs of an attempt | Until the result is admitted. Otherwise, 1 hour after the attempt ends. A worker restart deletes them. | None | The same sweep |
| Repository checkouts of the worker | No automatic deletion | None | Nothing deletes them |
Server disk
| Data | Retention | Setting | Deleted by |
|---|---|---|---|
Repository mirrors, on the git-repos volume | No age limit. The server deletes a mirror when no workspace monitors its repository. | None | Repository monitoring |
PostgreSQL
The jobs that delete review job data run only when AGENT_ENABLED is true.
| Data | Retention | Setting | Deleted by |
|---|---|---|---|
| Capture and output of a review job | 14 days after the job ends. A job that waits for delivery keeps them. | hephaestus.agent.payload-retention | A server job every 6 hours |
| Review job rows, with their script runs and attempt usage | 90 days after the job ends | hephaestus.agent.row-retention | The same job |
| Original review inputs (composition basis) | Until they expire. The end of the job also deletes them. | None | The same job |
| Evidence-copy receipts | As long as their review job row. After that, until the worker that held the copy confirms its removal. | hephaestus.agent.row-retention | The same job, after the worker confirms. Person erasure and workspace purge clear the identities earlier. |
| Evidence of an item event | Replaced by a marker 30 days after it is recorded | hephaestus.item-event-ledger.retain-for | A server job every 15 minutes |
| Item events that nothing references | 30 days after their decision | hephaestus.item-event-ledger.retain-for | The same job |
| Item events that stay pending | They expire after 7 days. The expired row goes 30 days later. | ITEM_EVENT_LEDGER_PENDING_LAPSE_AFTER, hephaestus.item-event-ledger.retain-for | The same job |
| Practice results that no feedback cites, and the raw proof of scans | 400 days | None | A server job at 03:00 every day |
| Feedback and its delivery records | No automatic deletion. Conversation feedback that is never shown is withheld after 14 days and kept. | None | Workspace purge or person erasure |
| LLM usage records | 400 days | HEPHAESTUS_LLM_USAGE_RETENTION | A server job at 04:15 every day |
| conversations | No automatic deletion | None | Workspace purge, person erasure, or Slack disconnection |
| Slack messages and threads | 30 days for each connection, at most 180 days | None | A server job at 03:30 every day |
| Outline documents | No age limit. Document bodies above 200 MB for each workspace are evicted. | hephaestus.integration.outline.cache.max-size-mb | Outline sync |
| GitHub and GitLab mirror tables | No age limit while a workspace monitors the repository | None | Repository monitoring |
| Sync job history | The newest 50 runs of each connection | None | Each new sync run |
| Connection audit records | No automatic deletion | None | Workspace purge |
| Authentication events, including sign-ins, user views, IP address, and user agent | 12 months, in monthly partitions | None | Partition maintenance at 00:10 every day |
| Configuration audit events | 365 days | None | A server job at 00:20 every day |
| Issued access tokens | Until they expire. Access tokens last 24 hours. | hephaestus.auth.access-ttl | A server job at 03:30 every day |
| Client sessions | At most 7 days. A revoked session goes 1 day after revocation. | hephaestus.auth.session-max-lifetime | A server job every hour |
| OAuth state values | 7 days | hephaestus.integration.oauth-state.nonce-retention | A server job at 04:00 every day |
| Email notifications waiting for delivery | Deleted when delivered. An account deletion confirmation expires at the purge deadline. Security, alert, and weekly digest mail expires after 24 hours. Product feedback mail expires after 7 days. Survey mail expires with its request. | None | Delivery and the retry job |
| Self-service account exports | The download goes 48 hours after it is ready. | None | A server job every hour |
| Deleted accounts | Removed 48 hours after the request, by the next hourly sweep | hephaestus.auth.delete-cooldown | A server job every hour |
| Product feedback and survey responses | No automatic deletion | None | Account erasure, survey deletion, or workspace purge |
| Research disclosure records | No automatic deletion. The released file is not stored. | None | Closure of the disclosure removes its mapping |
NATS JetStream
The nats-data volume keeps webhook deliveries.
Each stream deletes its oldest messages first when it reaches its age limit or its size limit.
Webhook ingestion operations gives the limits of each stream and their settings.
Logs and traces
| Data | Retention | Where to change it |
|---|---|---|
| Logs of the webapp, server, worker, PostgreSQL, and volume setup containers | By size only: 5 files of 50 MiB | The logging block of the service |
| Logs of the webhook server, NATS, reverse proxy, and maintenance page | By size only: 3 files of 10 MiB | The logging block of the service |
| Journal logs, with the optional journald overlay | The journal size limit of the host | SystemMaxUse in journald.conf |
| Logs shipped to Loki | The retention that you set in Loki | Loki |
| Traces | Off by default. The OTLP recipient keeps them under its own retention. | TRACING_OTLP_ENABLED |
No container writes an HTTP access log.
Backups
| Data | Retention | Where to change it |
|---|---|---|
| pgBackRest backups, with the optional backup overlay | Two full backups, with their differential backups and WAL. Backup & restore gives the schedule. | repo1-retention-full in pgbackrest.conf |
A plain pg_dump file | No automatic deletion | Delete the file yourself |
A backup contains the whole database, so it also contains data that the instance deleted later. Erasure does not reach a backup. Backup & restore gives the restore procedure.