← Oktra · Privacy Policy · Service Disclaimer

Oktra Data Retention and Disposal Policy

Version 1.0 · Effective 2026-07-06 · Reviewed annually · Contact: privacy@oktra.ai

1. Principle

Oktra retains personal and financial data only as long as it is needed to provide the service or to meet a legal obligation, and disposes of it by defined, verifiable means. The customer's accounting platform remains the system of record; Oktra can re-derive its working state, so retention here is deliberately short.

2. Data classes and retention periods

Data class	Where held	Retained	Disposal trigger
Connection credentials (OAuth tokens, API keys)	Per-connection encrypted vault	While the connection is active	Disconnection or offboarding: token revoked at the provider AND the connection's vault purged, in that order
Financial data retrieved via connected providers (transactions, balances, account metadata)	Production database	While the customer account is active	Erased within 30 days of customer offboarding or verified erasure request
Connection directory and metadata (tenant-connection binding, company names, external identifiers)	Production database	While the customer account is active	Erased with the customer account (same window as above)
Customer account data (users, settings)	Production database	While the customer account is active	Erased on offboarding, subject to §3 legal holds
Audit records of writes to customer financial systems	Append-only audit store	7 years (statutory financial-records window, §3)	Aged out on schedule; retained independently of customer offboarding
Security/operational logs (vault access, sign-in, service logs)	Platform log stores	Per platform diagnostic retention settings, reviewed annually	Aged out automatically; contain no secrets by design
Backups	Platform backup schedules; image backups (on-premises)	Backup retention window only	Deleted data ages out of backups with the backup cycle; backups are not a retrieval path for erased customer data

3. Legal holds and obligations

Where a statutory obligation requires retention beyond the table above, the specific records are retained for the statutory period and erased when it lapses. The 7-year audit-record window is anchored on financial-records obligations in both operating regions (EU bookkeeping-retention law and US tax record-keeping guidance). A legal hold suspends disposal for affected records only and is recorded with its lifting condition.

4. Disposal methods

• Secrets: vault purge (soft-delete window then permanent destruction per vault configuration); provider-side revocation always precedes local purge so no live grant is ever unrecorded.
• Database records: hard deletion of the customer's rows (the schema uses no soft-delete columns; deletion is deletion).
• Backups: no selective backup editing - erased data leaves backups by aging out of the retention cycle; restores after an erasure re-apply pending erasures before service resumes.
• Hardware: decommissioned disks/workstations are wiped or physically destroyed before disposal.

5. Data subject and consumer requests (all jurisdictions)

One process for everyone: verified erasure requests are honored within the 30-day window of §2 regardless of the requester's residency - account data, financial data, metadata, and connection secrets are disposed of per §4, and completion is recorded. Audit records and legally-held records are excluded per §3 and the requester is informed of the exclusion and its basis.

Jurisdictional mapping (the same process satisfies each regime):

• EU/EEA/UK (GDPR / UK GDPR): the 30-day window meets the one-month response deadline for erasure and access requests (Art. 12/17); the lawful bases and disclosures are stated in the privacy policy.
• United States (state privacy laws, e.g. CCPA/CPRA): the 30-day window is inside the 45-day response deadline; consumer deletion and access rights are honored through the identical process.
• Other jurisdictions: the same process applies as a matter of policy.

6. Enforcement and review

• Disconnection/offboarding disposal (revoke + purge ordering) is a designed-in, tested capability of every connector.
• This policy is reviewed annually with its parent security policy, and its application is spot-checked in quarterly access reviews.
• Retention statements in the privacy policy mirror this policy; any change here propagates to the published privacy policy in the same change.