Data retention
Data Governance is where a company admin controls how long trace data lives, how PII is handled, and how a data subject is permanently erased on request. The page is organized into four tabs — Overview, Retention, PII Redaction, and Erasure — and this page covers the Overview and Retention tabs. See PII redaction and Erasure for the other two.
At a glance
| Where | Data Governance in the left nav (Admin group) → Retention tab |
| Who can use it | Company admins only — members and viewers get 403 |
| Key API routes | GET/PUT /retention/policies, DELETE /retention/policies/{id} |
| Scope | Company-wide, with optional per-agent overrides |
| Runs | A nightly purge job deletes data older than each agent’s effective window |
Overview tab
The Overview tab is the tab you land on — a posture snapshot across all three other tabs, so an admin can tell at a glance whether anything needs attention without opening each one:
- Retention — the company-wide default window and how many agents currently carry an override.
- PII redaction — the redaction mode and whether Enforced is on, so it’s obvious whether a client-supplied header could still weaken it.
- Erasure — recent erasure requests and their status, so an in-flight or failed request is visible without opening the Erasure tab.
Each tile links straight into the tab it summarizes.
Configure retention
Retention decides how long an agent’s traces are kept before Neens purges them. You set one company-wide default, then optionally override it per agent.
Set the company-wide default
Under Retention → Company-wide default, enter a number of days and Save default
(PUT /retention/policies with scope_type: "company"). This applies to every agent that
doesn’t have its own override. For example, entering 365 keeps a year of trace data for every
agent with no override.
A value of 0 means “keep forever” — it’s the safe default, so existing tenants never lose
data until an admin opts in. Any negative or malformed value is coerced to 0 (keep forever), so
a bad policy can never silently delete data with a surprise short window.
Add a per-agent override
Under Retention → Add override, pick an agent and a window, then Add override
(PUT /retention/policies with scope_type: "project" and the agent’s id). For example, to
keep only 90 days of data for a high-volume Order Tracking agent while the rest of the
company keeps a year, select Order Tracking, enter 90, and save. An override always wins
over the company default. Setting an agent’s override to 0 explicitly exempts it from a
shorter company policy.
Read the Retention by agent table
The Retention by agent table is the single merged view of what Neens will actually apply, per agent — there’s no separate “overrides” table and “effective window” table to cross-reference:
| Agent | Effective window | Source |
|---|---|---|
| Order Tracking | 90 days | Override |
| Support Agent | 365 days | Company default |
| Billing Assistant | 365 days | Company default |
- Effective window is what the nightly purge actually uses for that agent.
- Source is Override when the row came from that agent’s own policy, or Company default when it’s falling through to the company-wide setting. A row never shows a bare number without telling you which one produced it.
Reset an override
To go back to the company default for an agent, remove its row (Remove policy,
DELETE /retention/policies/{id}) from the override list. This deletes the policy, not any
data — the agent’s Source in the table immediately flips from Override to Company
default and its effective window becomes whatever the company-wide setting is.
How the effective window resolves
For any agent, Neens resolves the window most-specific-first:
- a per-agent override, else
- the company-wide policy, else
- the platform’s built-in default (keep forever).
0 at any level is a real configured value (“keep forever”), not a fall-through — an admin who
sets an agent to 0 is deliberately exempting it.
What the nightly purge does
A scheduled job runs once a night and, for every company, resolves each agent’s effective
window and deletes data older than now − window across both stores — the analytics store
and the operational store (traces, spans, tool calls, scores, and derived records). Because it
uses the same delete cascade as erasure, retention coverage stays
complete.
Retention runs even when an agent has no override and no company policy — a true no-op only happens when both resolve to “keep forever.”
Permissions
Retention requires the company admin role (roles order viewer < member < admin).
Members and viewers can’t open Data Governance, and the API returns 403 for the retention
endpoints. A company’s data lives in its own physically isolated storage, so a policy can never
reach another tenant. Every policy change is recorded in the audit log.
Related
- PII redaction — the PII Redaction tab: scrub sensitive values out of traces before they’re stored.
- Erasure — the Erasure tab: permanently delete one data subject’s data on request (GDPR Art. 17).
- Audit log — the immutable record of retention-policy changes.
- Workspace, orgs & agents — how agents scope your data and per-agent overrides.