Records Retention & Protection Policy¶
Purpose. Defines how long Soon keeps its records, how they are protected while retained, and how they are deleted — including the GDPR processor obligation to return or delete customer data.
1. Scope¶
Applies to all business records Soon holds, wherever stored (AWS, Stripe, Google Workspace, GitHub, monitoring tools). All records are electronic; Soon has no offices and holds no paper archives.
2. Policy¶
2.1 Principles¶
- Records must be kept only as long as required by law, contract or business need, and no longer.
- Records are protected according to their classification: encrypted at rest (AES-256) and in transit (TLS 1.2+), access-controlled per the Access Control Policy, and backed up per the Backup Policy.
- When the retention period ends, records must be deleted from production and, in due course, expire from backups.
2.2 Retention schedule¶
| Record type | Where held | Retention | Basis |
|---|---|---|---|
| Customer data (workforce/PII processed for customers) | AWS eu-west-1 (RDS) | Duration of the customer contract, then deleted 90 days after contract end (confirmed 2026-08-08). Backups containing it age out afterwards on their own 7d/30d cycle. | GDPR processor obligation / customer DPA |
| Financial records (invoices, payments, accounting) | Stripe / accounting system | TODO(owner): confirm statutory retention period per Soon's country of establishment (typically 7+ years) | Tax/commercial law |
| HR records (contracts, payroll, performance) | Google Drive (Soon shared drive) — HR records | TODO(owner): confirm statutory periods with the accountant (NL: payroll/tax records generally 7 years) |
Employment law / GDPR |
| Contracts and customer agreements (incl. DPAs) | Google Drive (Soon shared drive) | Contract term + limitation period. TODO(owner): confirm with the accountant (NL limitation period is generally 5 years, 7 for tax-relevant records) |
Legal claims/defence |
| Application and infrastructure logs | CloudWatch, Sentry, CloudTrail | CloudWatch/Sentry 90 days · CloudTrail and audit logs 1 year (confirmed 2026-08-13) | Security operations |
| ISMS records (policies, risk assessments, reviews, incidents, evidence) | This repository / S3 evidence store | Current + previous certification cycle (3 years) — this is the baseline for the evidence store's S3 Object Lock retention (see ISMS-DOC-07-7 §4.4). | ISO 27001 audit trail |
Where a specific case needs longer retention (e.g. legal hold), the policy owner decides and records the exception.
2.3 GDPR processor obligations¶
As a data processor, Soon must return and/or delete each customer's personal data at the end of the service, as the customer chooses and as set out in the DPA, and must not keep it beyond that except where EU or member-state law requires storage. Deletion actions must be recorded.
2.4 Deletion¶
- Deletion must remove records from active systems; backups expire on their normal rotation schedule.
- Decommissioned storage is handled by the cloud provider (AWS) under their certified media disposal processes; Soon holds no physical media.
3. Roles & responsibilities¶
- Record owners (per record type above) — apply the retention periods and execute deletion.
- Engineering lead (Thomas Picauly) — implements retention/deletion for customer data and logs.
- Policy owner (Olaf Jacobson, ISM) — maintains the schedule, resolves the TODO periods with legal advice, approves exceptions and legal holds.
4. Related documents¶
- Privacy and Personal Data Protection Policy
- Information Asset Inventory
- Backup Policy
- Information Deletion Policy
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2023-12-11 | Olaf Jacobson | First draft document |
| 0.2 | 2026-07-18 | Andrea Cardinali | Rewritten lean and Soon-specific (ISMS overhaul) — dropped paper/microfiche/SOX content; retention table rebuilt around Soon's real record types |
| 0.4 | 2026-08-13 | ISMS | Storage locations set from the owner's folder map (contracts, DPAs and HR records in Google Drive; incident and deletion records in Linear); log retention set to 90 days for app logs and 1 year for audit logs. Statutory financial/HR periods remain open pending the accountant. |
| 0.3 | 2026-08-08 | ISMS | Owner answers applied: customer data deleted 90 days after contract end; ISMS/evidence retention set to 3 years (drives S3 Object Lock); removed stale Supabase reference. |