Source: docs/integration/privacy-and-retention.md

Privacy and retention policy for the integration MVP

This policy describes the minimum handling of data sent through Forgium. The

host application remains responsible for its own user notice, lawful basis,

access controls, and deletion obligations.

Data classes

Class	Stored by Forgium	Purpose	Default retention
Message text	Conversation and message records	Generate and audit a reply	30 days
Action metadata	Action ID, capability ID/revision, status, expiry, subject IDs, hashes	Confirmation and execution	30 days after terminal state
Capability audit	IDs, SHA-256 hashes, timing, HTTP status, stable error codes	Security and operations	90 days
Credentials	AES-GCM ciphertext only	Authenticate an endpoint	Until revoked, then 30 days for deletion evidence
Signing material	Private key in the Worker secret store only	Sign outbound context	Managed by key-rotation policy; never stored in D1

Bodies, bearer tokens, complete JWS values, and capability arguments are not

written to capability audit records. Staging fixtures use synthetic data only.

Access is limited to the authenticated host backend, the Forgium runtime for

execution, and authorized Operations/Security personnel for incident response.

Support access is time-limited, logged, and must use redacted identifiers.

The host application can request deletion of conversations, messages, action

records, credentials, and related audit records through the operational owner.

Deletion requests are acknowledged with scope, timestamp, requester, and

completion evidence. Legal holds or active incident investigations may delay

deletions; the requester receives the reason and expected review date.

For suspected disclosure, the host application must revoke the endpoint token

and Forgium access bundle, preserve redacted evidence, and contact the

platform incident owner. Forgium Operations rotates affected credentials or

signing keys, reviews security events, and communicates impact and recovery

steps. Never include secrets or raw message bodies in an incident ticket.

This MVP policy requires Product, Legal, and Security approval before a

production access bundle is issued. Changes to retention, data classes, or

support access require a documented review.