Skip to content
Wavertex
Documentation menu

Retention and erasure

Verified with Cortex on October 2, 2026

Cortex keeps conversations as long as no retention duration is configured: until a policy exists, nothing is deleted. This console page, under "Retention" (page "Retention & erasure"), lets you set that duration, purge on demand and permanently erase a person's data. It is reserved for the "Administrator" role. Its subtitle mentions Law 25: these functions are designed to help you meet your obligations, they do not replace your own analysis.

Three cards summarize the state: "Current policy" ("Not configured" at the start), "Purgeable now" and "Last purge". Two tabs follow: "Retention durations" and "History".

Retention durations

The policy covers "Chat conversations": employee messages and model answers. A conversation is purged once it has been inactive for longer than the chosen duration. The purge deletes the conversation with its messages, its "Redactions" and its "Re-identification tokens".

Cortex screenshot: the Retention & erasure page, a 365-day policy for conversations, the purgeable volume, and the audit journal as append-only
The “Retention durations” tab: a 365-day policy for conversations; the audit journal stays “Append-only”.
  1. In the "Retention durations" tab, turn on the "Auto-purge" switch of the "Chat conversations" row.
  2. Choose the "Retention": 30, 60, 90 (default), 180, 365 or 730 days.
  3. Click "Save durations". Until you do, the message "Unsaved changes — they apply from the next purge run." stays displayed.

To remove the policy, turn "Auto-purge" off and save: nothing is purged any more. A policy change is recorded in the audit journal as "Retention policy updated".

The gateway applies the purge every hour, for every active tenant. Under Docker Compose that interval is fixed: RETENTION_PURGE_INTERVAL_MS is not passed to the gateway. It only takes effect for a gateway started directly on the host, or once added to the gateway's environment: block. See Configuration.

To purge right away, click "Purge now" in the header of the "Durations per data category" card. The window shows the exact volumes that will be deleted; click "Purge now" again to confirm. "Purge completed" reports what was deleted. This cannot be undone. With no saved policy, it deletes nothing.

Erase a person

The "New erasure…" button is at the top of the page. The erasure targets either "A user (all their content)" or "A single conversation" (you enter its UUID).

  1. Click "New erasure…", choose the target (the user from the "Choose a user…" list, or the conversation id), then click "Continue".
  2. The "Confirm permanent erasure" window shows a preview of the exact volumes: "Conversations", "Messages", "Redactions" and "Re-identification tokens". The "Audit journal entries" line says "kept". This confirmation is valid for 5 minutes.
  3. Tick "I confirm this request has been verified and the erasure cannot be undone."
  4. Type the word ERASE in the "Step 2 — type ERASE to confirm" field. Case does not matter.
  5. Click "Erase permanently". "Erasure completed" reports the volumes actually erased; click "Close".

The "Erase permanently" button stays inactive until the box is ticked and the word is typed. If the confirmation expires or fails, it is spent: click "Request a new confirmation". If the target no longer exists, the window says so.

For a user, Cortex deletes all their conversations, then scrubs the account to an opaque identifier: email, name, credentials and roles are removed, and active sessions are revoked. The erasure covers only conversations and the account. Cortex also empties the tenant's response cache. To create or disable accounts, see Users and access.

What the audit keeps

Retention purges and the erasure of a person or a conversation never touch the audit journal. Only uninstalling the instance, which discards the database, removes it; the tenant erase procedure destroys encryption keys and adds an entry, it does not delete audit rows. The journal is append-only ("Append-only") and hash-chained, so an alteration is detectable (see Audit journal). An erasure therefore removes content, never the trace of the event. The operation is itself recorded under your identity, as "User erased" or "Conversation erased", with identifiers and counters. Entries already written about the person remain. According to the console's own text, the audit entry records entity types only, never their values.

History

The "History" tab ("Purge & erasure history") is read-only. It lists the 30 most recent events from the audit journal: "Timestamp", "Event" ("Scheduled purge", "Manual purge", "Conversation erased" or "User erased"), "Operator" ("System" for a scheduled purge) and "Audit ref". The "View everything in Audit" link opens the full journal. A purge that deletes nothing leaves no line there.