Legal · Retention and deletion
Data Retention and Deletion Policy
Drafting complete · Counsel review required before MVP
This document is not legal advice, has not been reviewed by a licensed attorney, and is not an executed contract. It is published in this state on purpose: it describes CorpusAegis as built and measured on 2026-08-04, including the controls that do not yet exist. Review by qualified counsel is a gate on MVP and on any customer engagement.
Controller: the Customer. Processor: TrueSynthesis Inc, a Texas corporation, operating the CorpusAegis service.
1Scope
“Customer Data” means the documents you supply, everything derived from them, and the records of their use.
| Class | Examples | Where it lives |
|---|---|---|
| Source documents | Uploaded PDF, DOCX, PPTX, XLSX, HTML, Markdown | Object storage (Cloudflare R2) |
| Derived retrieval assets | Parsed text, chunks, embeddings, lexical index | Index artifact, versioned |
| Question and answer records | Questions, answers, citations, questions the system declined | Application database and run logs |
| Evaluation material | Gold answers, reference evidence, sealed Forms A and B, grading records | Custodian-held, separate from development |
| Model artifacts | Adapters or merged weights trained on your data | Model volume, per tenant |
| Operational telemetry | Latency, token counts, cost meter, error records | Logs |
Fine-tuned adapters and retrieval indexes are themselves Customer Data. They are derived from your documents and treated as sensitive assets, not as CorpusAegis work product. Counsel must confirm this characterization survives the intellectual-property clause of the master agreement, which assigns the general platform to TrueSynthesis and the delivered corpus, index, and adapters to the customer.
2Retention periods
| Data class | While the agreement is live | After termination |
|---|---|---|
| Source documents | For the term | Deleted within 30 days of a deletion request or of termination, whichever is first |
| Derived retrieval assets | For the term | Deleted within 30 days; index artifacts are destroyed, not merely unindexed |
| Question and answer records | 90 days rolling, unless you elect longer in writing | Deleted within 30 days |
| Evaluation material | The term plus the certification-validity period | Sealed forms and answer keys destroyed within 30 days unless you request their return |
| Model artifacts | For the term | Deleted within 30 days, or delivered to you where the licence permits redistribution |
| Operational telemetry | 13 months | Retained in aggregate, non-identifying form only |
| Backups | Rolling 35 days | Expire on the ordinary backup cycle — see §4 |
The 90-day question-and-answer default and the 13-month telemetry period are proposals, not constraints imposed by any executed contract. Both are subject to counsel review.
3Deletion commitments
CorpusAegis is designed to make deletion demonstrable rather than asserted. Cross-tenant isolation is physical — one index artifact per tenant and corpus, one database per tenant — so deletion is the destruction of named objects rather than the removal of rows from a shared table.
| Commitment | Mechanism |
|---|---|
| Deletion request acknowledged | Within 3 business days |
| Deletion executed | Within 30 days of the request |
| Certificate of deletion | Issued on request, listing the objects destroyed and the date |
| Sub-processor propagation | We instruct each sub-processor holding the affected data and confirm completion |
| Deletion of derived assets | A document deletion also invalidates and rebuilds the index. A document is not deleted while its chunks remain retrievable |
Re-index deny-by-default. A document present in a rebuilt index with no classification record in the access authority is deny-all. A rebuild never infers, guesses, or carries forward a prior permission. This exists so a routine operational action cannot become a silent disclosure.
4Backups — the honest limitation
Backups are not deleted on demand. A deletion request removes the data from live systems within 30 days; residual copies in encrypted, time-expiring backups persist until the ordinary backup cycle expires them, currently 35 days. Backups are not restored selectively to retrieve deleted Customer Data, and a restore that would reintroduce deleted data is followed by re-deletion.
This limitation is stated rather than concealed. Delete the object and its versions is demonstrable. Delete rows and hope no index, write-ahead-log segment, backup, or cache retains them is not, and CorpusAegis does not claim it.
The 35-day figure is a stated target, not a verified measurement. See §7.
5Sub-processors
Reflects the deployed hosted configuration verified 2026-08-04.
| Sub-processor | Role | Receives document text? |
|---|---|---|
| Modal Labs, Inc. | Retrieval service and model-serving compute | Yes |
| Cloudflare, Inc. | Object storage for source documents; DNS | Yes, at rest |
| Vercel Inc. | Web application and API surface | Transits questions and answers |
| Neon Inc. | Identity and application data | No document text today |
A material fact for the hosted tier. Answer generation runs on open-weight models self-hosted by TrueSynthesis. The service health endpoint reports no third-party model provider. No third-party model API receives customer document text in this configuration.
This is not automatic and must not be assumed. Third-party model APIs are used in our own evaluation and judging work, on public and synthetic corpora. For a customer tenant, the answer and judge model configuration is pinned to self-hosted weights and verified. Whether any tier may ever route customer text to a third-party provider is an open decision for counsel and the owner; until it is resolved, no customer tenant is configured with one.
6What CorpusAegis will not do
- Customer Data is never used to train models for another customer, or for any general-purpose model.
- Customer Data is never used to improve CorpusAegis outside your own tenant, except as non-identifying aggregate operational telemetry.
- Customer questions and answers are never published to any public feed. The public try-to-break-it log applies only to public, single-tenant proof corpora and never becomes a cross-tenant channel.
7What this policy has not yet proven
Recorded openly rather than smoothed over. Each must close before this policy is offered to a customer.
- The 35-day backup window is a target. The actual configured retention at each sub-processor has not been checked. Unverified.
- No deletion has ever been executed end to end and evidenced. The mechanism is designed; the drill has not been run.
- Certificate-of-deletion tooling does not exist.
- Sub-processor propagation is manual and unrehearsed.
- The 30-day deletion commitment has never been measured against a corpus of customer scale.
The security measures this policy relies on include permission-aware retrieval enforced inside each retrieval backend before results are returned. That control is designed and not yet built. Until its security acceptance closes, no privacy or security claim derived from that design is published, and no multi-user tenant is onboarded. Request throttling is limited: the signed-in demo routes have a per-user limit held in each server instance's memory. It is not a global or durable limit, a spend cap on the model host has not been verified, and rate limits for customer API keys are not built.
8Contact
Data protection enquiries: a dedicated address is still to be created. TrueSynthesis Inc, 5900 Balcones Drive, STE 100, Austin, TX 78731, USA.
Last revised 2026-08-04 · Source of record docs/legal/POLICY_DATA_RETENTION_AND_DELETION.md · Data Processing Addendum
TrueSynthesis Inc · 5900 Balcones Drive, STE 100, Austin, TX 78731, USA