# Data retention This page lists what a self-hosted instance stores, where, and for how long. Each period comes from the code or the shipped configuration. "No automatic deletion" means that no scheduled job deletes the data. The **Deleted by** column then names what still removes it. The [personal-data map](/admin/dsms/personal-data-map.md) describes workspace purge, disconnection, and verified person erasure. The operator's [record of processing](/admin/dsms/record-of-processing.md) gives the legal basis of each category. The **Setting** column names the environment variable when the supported stack forwards it from `.env`. Otherwise, it names the Spring property, and the value is fixed in the supported stack. The [configuration reference](/admin/configuration-reference.md) lists the settings that have an environment variable. The times of the scheduled jobs are in the time zone of the server process. ## Worker disk The worker keeps these files under `/data/worker-git-repos`, on the `worker-git-repos` volume. | Data | Retention | Setting | Deleted by | | ---------------------------------- | ------------------------------------------------------------------------------------------------------ | ------- | --------------------------- | | Debug transcript of an agent run | 24 hours. It goes earlier when the job's evidence expires. | None | A worker sweep every minute | | Inputs of an attempt | Until the result is admitted. Otherwise, 1 hour after the attempt ends. A worker restart deletes them. | None | The same sweep | | Repository checkouts of the worker | No automatic deletion | None | Nothing deletes them | ## Server disk | Data | Retention | Setting | Deleted by | | --------------------------------------------- | ------------------------------------------------------------------------------------ | ------- | --------------------- | | Repository mirrors, on the `git-repos` volume | No age limit. The server deletes a mirror when no workspace monitors its repository. | None | Repository monitoring | ## PostgreSQL The jobs that delete review job data run only when `AGENT_ENABLED` is `true`. | Data | Retention | Setting | Deleted by | | --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | Capture and output of a review job | 14 days after the job ends. A job that waits for delivery keeps them. | `hephaestus.agent.payload-retention` | A server job every 6 hours | | Review job rows, with their script runs and attempt usage | 90 days after the job ends | `hephaestus.agent.row-retention` | The same job | | Original review inputs (composition basis) | Until they expire. The end of the job also deletes them. | None | The same job | | Evidence-copy receipts | As long as their review job row. After that, until the worker that held the copy confirms its removal. | `hephaestus.agent.row-retention` | The same job, after the worker confirms. Person erasure and workspace purge clear the identities earlier. | | Evidence of an item event | Replaced by a marker 30 days after it is recorded | `hephaestus.item-event-ledger.retain-for` | A server job every 15 minutes | | Item events that nothing references | 30 days after their decision | `hephaestus.item-event-ledger.retain-for` | The same job | | Item events that stay pending | They expire after 7 days. The expired row goes 30 days later. | `ITEM_EVENT_LEDGER_PENDING_LAPSE_AFTER`, `hephaestus.item-event-ledger.retain-for` | The same job | | Practice results that no feedback cites, and the raw proof of scans | 400 days | None | A server job at 03:00 every day | | Feedback and its delivery records | No automatic deletion. Conversation feedback that is never shown is withheld after 14 days and kept. | None | Workspace purge or person erasure | | LLM usage records | 400 days | `HEPHAESTUS_LLM_USAGE_RETENTION` | A server job at 04:15 every day | | conversations | No automatic deletion | None | Workspace purge, person erasure, or Slack disconnection | | Slack messages and threads | 30 days for each connection, at most 180 days | None | A server job at 03:30 every day | | Outline documents | No age limit. Document bodies above 200 MB for each workspace are evicted. | `hephaestus.integration.outline.cache.max-size-mb` | Outline sync | | GitHub and GitLab mirror tables | No age limit while a workspace monitors the repository | None | Repository monitoring | | Sync job history | The newest 50 runs of each connection | None | Each new sync run | | Connection audit records | No automatic deletion | None | Workspace purge | | Authentication events, including sign-ins, user views, IP address, and user agent | 12 months, in monthly partitions | None | Partition maintenance at 00:10 every day | | Configuration audit events | 365 days | None | A server job at 00:20 every day | | Issued access tokens | Until they expire. Access tokens last 24 hours. | `hephaestus.auth.access-ttl` | A server job at 03:30 every day | | Client sessions | At most 7 days. A revoked session goes 1 day after revocation. | `hephaestus.auth.session-max-lifetime` | A server job every hour | | OAuth state values | 7 days | `hephaestus.integration.oauth-state.nonce-retention` | A server job at 04:00 every day | | Email notifications waiting for delivery | Deleted when delivered. An account deletion confirmation expires at the purge deadline. Security, alert, and weekly digest mail expires after 24 hours. Product feedback mail expires after 7 days. Survey mail expires with its request. | None | Delivery and the retry job | | Self-service account exports | The download goes 48 hours after it is ready. | None | A server job every hour | | Deleted accounts | Removed 48 hours after the request, by the next hourly sweep | `hephaestus.auth.delete-cooldown` | A server job every hour | | Product feedback and survey responses | No automatic deletion | None | Account erasure, survey deletion, or workspace purge | | Research disclosure records | No automatic deletion. The released file is not stored. | None | Closure of the disclosure removes its mapping | ## NATS JetStream The `nats-data` volume keeps webhook deliveries. Each stream deletes its oldest messages first when it reaches its age limit or its size limit. [Webhook ingestion operations](/admin/webhook-ingestion-operations.md#how-long-a-delivery-is-actually-kept) gives the limits of each stream and their settings. ## Logs and traces | Data | Retention | Where to change it | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------- | ---------------------------------- | | Logs of the webapp, server, worker, PostgreSQL, and volume setup containers | By size only: 5 files of 50 MiB | The `logging` block of the service | | Logs of the webhook server, NATS, reverse proxy, and maintenance page | By size only: 3 files of 10 MiB | The `logging` block of the service | | Journal logs, with the optional journald overlay | The journal size limit of the host | `SystemMaxUse` in `journald.conf` | | Logs shipped to Loki | The retention that you set in Loki | Loki | | Traces | Off by default. The OTLP recipient keeps them under its own retention. | `TRACING_OTLP_ENABLED` | No container writes an HTTP access log. ## Backups | Data | Retention | Where to change it | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | | pgBackRest backups, with the optional backup overlay | Two full backups, with their differential backups and WAL. [Backup & restore](/admin/backup-restore.md#automated-off-host-backup-self-host-compose) gives the schedule. | `repo1-retention-full` in `pgbackrest.conf` | | A plain `pg_dump` file | No automatic deletion | Delete the file yourself | A backup contains the whole database, so it also contains data that the instance deleted later. Erasure does not reach a backup. [Backup & restore](/admin/backup-restore.md) gives the restore procedure.