What is data retention?

Data retention is the policy that defines how long recorded sessions and their associated data are stored before they are automatically and permanently deleted.

Why it matters

Every recording you keep is data you must protect, disclose on request and, eventually, justify. Privacy law expects personal data to be kept no longer than needed, and a replay of a support session from two years ago is rarely needed. Short retention is the cheapest privacy control you have.

Retention has to be enforced by the system, not by a calendar reminder. It should apply to the recording itself, not just the row that points at it, and deleting a session by hand should remove the same things. Whatever PII slipped past masking expires with the recording.

How AnyReplay handles it

AnyReplay retains sessions for 14 days by default, set per organisation and configurable. The API enforces the limit on an interval, and deleting a session deletes the recording, not only its metadata. Deletions, permission changes and key rotation are written to an append-only audit trail. If you self-host, the same rule covers backups: deploy/backup.sh keeps encrypted dumps for BACKUP_KEEP_DAYS, default 30, and a weekly verify restores the newest one into a throwaway database to prove it works. Combine retention with input masking and consent for the full picture on the privacy page.