Privacy engineering
Data Lifecycle & Retention Control
Operational privacy controls for collection, restricted raw storage, derived evidence, retention, correction, deletion propagation and data-subject operations.
6By data purpose/class
3Pending backup propagation
2Correction / access
4Awaiting re-screen
1 · CollectMinimum fields & approved sources
2 · ValidateQuality, identity, purpose gate
3 · AnalyzePrivate AI / governed connectors
4 · DecideReason codes + human review
5 · RetainData-class TTL & evidence minimization
6 · Delete / CorrectPropagation + re-score
| Data class | Examples | Default retention | Storage | Deletion behavior | Status |
|---|---|---|---|---|---|
| Raw legal documents | NIB/Akta/NPWP images | Policy-defined; shortest necessary | Restricted encrypted zone | Primary + derivatives + cache | Policy set |
| Extracted identity fields | Name, NIB, KBLI, address | KYB lifecycle + legal obligation | Case store | Correction propagates & re-scores | Policy set |
| External evidence | URL, source metadata, selected snippet/hash | Evidence-specific TTL | Evidence store | Delete/minimize subject to obligations | Minimized |
| Model telemetry | Confidence, latency, version | Short operational window | Telemetry | No raw personal data | Minimized |
| Decision/audit record | Reason, reviewer, rule/model versions | Policy/legal requirement | Immutable audit | Restricted deletion/retention rule | Controlled |
Deletion propagation simulation
Subject / merchant case: KYB-2026-0972
Primary case record
Raw document store
Derived search index
Connector cache
Backup expiry marker
Correction propagation
Correction to legal name or director identity invalidates stale entity matches and forces selective re-screening.
CorrectionIdentity field
→
InvalidateStale findings
→
Re-screenDependent modules
→
Re-scoreNew decision