Skip to content
KYRA MDR Documentation

Data Retention Policy

Data Retention Policy

Status: Active Policy Version: 1.1

Executive Summary

This document establishes data retention requirements for the KYRA AI MDR platform to ensure:

  • Compliance with regional data protection laws (GDPR, CCPA, SOX, PCI-DSS)
  • Legal defensibility through immutable audit trails and evidence preservation
  • Operational efficiency through automated lifecycle management
  • Cost optimization via tiered storage and intelligent purging

Data Classification & Retention Matrix

Primary Data Classes

Data ClassDescriptionBusiness JustificationBase Retention
Event DataRaw security events, logs, telemetrySOC investigation, forensics90 days (configurable: 30-365)
Alert DataProcessed alerts, investigations, triage resultsThreat hunting, pattern analysis365 days (configurable: 180-1095)
Incident DataCases, response activities, executive reportsCompliance audit, lessons learned6 years
Audit LogsPlatform access, configuration changesRegulatory compliance, breach investigation7 years (immutable)
Billing DataUsage metrics, invoicing recordsFinancial audit, revenue assurance7 years
Analytics DataPerformance metrics, AI training dataPlatform optimization, threat intelVariable (see below)

Analytics Data Retention

Data TypeRetentionBusiness Need
Alert metrics2 yearsThreat landscape trending
AI agent performance1 yearAI agent optimization
Ingestion throughput1 yearInfrastructure planning
Tenant daily summaries3 yearsFinancial reporting, SLA compliance

Tenant-Configurable Overrides

Tenants may extend (but not shorten) base retention periods within these limits:

Data ClassMin RetentionMax Retention
Event Data30 days365 days
Alert Data180 days3 years
Incident Data3 years7 years

Note: Audit logs and billing data retention periods are non-configurable for compliance reasons.

Legal holds ALWAYS override standard retention policies. Data under legal hold:

  • Cannot be purged regardless of configured retention period
  • Must be preserved in original format with integrity verification
  • Requires explicit legal counsel approval to release

Automatic legal holds are initiated for:

  • Regulatory subpoenas (SEC, FTC, DOJ, international equivalents)
  • Litigation discovery requests from tenant legal counsel
  • Security incidents classified as SEV1 (active compromise)
  • Data breach notifications requiring regulatory reporting

For EU tenants under GDPR:

  • Legal holds may conflict with “right to erasure” (Art. 17)
  • Platform maintains lawful basis documentation for each hold
  • Data subjects are notified when erasure is delayed due to legal proceedings

For US tenants under state privacy laws:

  • California CCPA: Legal holds exempt from deletion requests (1798.145(a)(1))
  • Virginia VCDPA: Similar litigation exemption applies

Automated Purge & Verification

Retention Enforcement

The platform automatically enforces retention policies on a daily schedule:

  • Evaluates all tenant data against configured retention periods
  • Respects legal hold protections before any purge operation
  • Generates cryptographic purge verification records

Before any purge operation, the system verifies:

  • No active legal holds exist on affected records
  • Records are not under extended retention by tenant configuration
  • Double-verification against the legal hold inventory

Purge Verification & Audit Proof

Every purge operation generates cryptographic evidence:

  • Cryptographic proof: HMAC-based verification of purged record identifiers
  • Audit record: Immutable log of records evaluated, purged, and protected
  • Verification capability: Compliance auditors can independently verify purge completeness

Data Residency & Sovereignty

Regional Data Pinning

Data residency is tenant-configurable based on regulatory requirements:

RegionData TypesCompliance Driver
EUAll tenant dataGDPR Art. 44-49
USAll tenant dataSOX, HIPAA, FedRAMP
APACAll tenant dataRegional banking, PDPA
GlobalAnalytics onlyLatency optimization

Cross-Border Transfer Controls

Principle: Customer data remains in designated region unless explicitly authorized.

Permitted Cross-Border Transfers

  1. Platform diagnostics (anonymized telemetry only)
  2. Legal compliance (subpoena, mutual legal assistance)
  3. Customer-initiated export (hunt query results, threat reports)

Data Localization Compliance

EU (GDPR) Requirements

  • Primary storage: Must be within EU/EEA
  • Backups: Encrypted backups may be stored in US with appropriate safeguards
  • Analytics: Aggregated/anonymized analytics may be processed globally
  • Legal basis: Article 6(1)(f) legitimate interest for security operations

US Requirements

  • Federal customers: FedRAMP boundary (US-only storage and processing)
  • Financial services: SOX compliance requires US or equivalent jurisdiction
  • Healthcare: HIPAA permits US storage with proper BAAs

GDPR Right to Erasure

Data Subject Request Processing

When a data subject exercises their right to erasure:

  1. Data subject identity is validated
  2. Active legal holds are checked for conflicts
  3. All personal data records are identified across the platform
  4. Records are pseudonymized (preserving analytics value) or fully deleted
  5. Erasure completion is logged and the data subject is notified

Pseudonymization vs. Deletion

ScenarioActionRationale
Analytics recordsPseudonymizationPreserves threat intelligence patterns
Audit logsPseudonymizationMaintains compliance trail integrity
Raw event dataFull deletionNo analytical value after pseudonymization
Legal hold dataDelayed deletionRegulatory/litigation requirements

Tiered Storage

Data is automatically moved through storage tiers to optimize costs:

TierAccess PatternUse Case
HotFrequent accessActive investigations, recent alerts
WarmInfrequent accessHistorical alerts (30+ days)
ColdRare accessArchived events (90+ days)
FrozenDeep archiveLong-term compliance retention (365+ days)

Backup Retention

Data TypeBackup FrequencyRetention Period
Production databaseContinuous30 days
Daily snapshots24 hours90 days
Weekly snapshots7 days1 year
Monthly snapshots30 days7 years

Cross-Region Backup Compliance

  • EU tenant data backups are encrypted with EU-managed keys
  • US backup storage requires adequacy decision or Standard Contractual Clauses
  • Backup restoration triggers cross-border transfer logging

Retention Policy Monitoring

Key Metrics Tracked

  • Data age distribution by tenant and data type
  • Purge operation success rate (target: 99.9%)
  • Legal hold count and average duration
  • Storage cost optimization savings via tiering
  • GDPR request processing time (target: <30 days)
  • Cross-border transfer audit trail

Automated Alerts

  • Purge operation failures trigger immediate security team notification
  • Records exceeding retention limits trigger compliance team alerts
  • Legal holds exceeding 3 years trigger legal counsel review

Policy Owner: Chief Information Security Officer (CISO) Review Frequency: Annual or upon regulatory changes