Data Retention & Disposal Policy

1. Purpose

This policy defines the requirements for retaining, archiving, and securely disposing of data held by XBert Pty Ltd. It ensures compliance with Australian privacy legislation and contractual obligations to customers while minimising risk from holding data longer than necessary.

2. Scope

This policy applies to all data processed, stored, or transmitted by XBert systems, including:

• Customer accounting data (synced from Xero, QuickBooks, MYOB, FreeAgent, XPM)
• Employee and payroll data (synced from Xero Payroll, Employment Hero)
• User account and identity data (managed via Auth0)
• Application logs and telemetry
• Internal business records and communications
• Backup and disaster recovery copies
• AI processing data (ephemeral data sent to AI providers)

3. Definitions

Term	Data Classification	Definition
Customer Data	Confidential	Accounting and financial data belonging to customer organisations, synced via OAuth 2.0 integrations
User Data	Internal	Personal information associated with individual user accounts (name, email, role)
Operational Data	Internal	Logs, metrics, telemetry, and audit trails generated by XBert systems
Ephemeral Data	Confidential (in transit)	Data transmitted to third-party AI services for processing that is not persisted by the provider

Data classifications align with the three-tier scheme defined in the Architecture & Design document (Confidential, Internal, Public).

4. Data Retention Schedule

4.1 Customer Accounting Data

Data Category	Retention Period	Storage Location	Notes
Active customer data	Duration of subscription	Azure SQL (Australia Southeast)	Synced from accounting platform
Disconnected client data	90 days post-disconnection	Azure SQL (Australia Southeast)	Grace period for reconnection
Deleted account data	Purged within 30 days of account deletion	All data stores	Includes all backups within retention window

4.2 User and Identity Data

Data Category	Retention Period	Storage Location	Notes
Active user profiles	Duration of account	Auth0 + Azure SQL	Managed via Auth0 identity provider
Deactivated user profiles	90 days post-deactivation	Auth0 + Azure SQL	Then permanently deleted
Authentication logs	90 days	Auth0	Per Auth0 retention policy

4.3 Operational Data

Data Category	Retention Period	Storage Location	Notes
Application logs	90 days (hot) + 12 months (cold)	Azure Log Analytics + Blob Storage	Rolling retention
Audit trails	12 months (hot) + 7 years (cold)	Azure Log Analytics + Blob Storage	Regulatory compliance
Security event logs	12 months (hot) + 7 years (cold)	Microsoft Defender for Cloud	Incident investigation
Performance telemetry	90 days	Application Insights	Aggregated metrics retained longer

4.4 Backup Data

Data Category	Retention Period	Storage Location	Notes
Database backups (PITR)	28 days	Azure SQL (geo-replicated within Australia)	Point-in-time recovery
Long-term backups	12 months	Azure Blob Storage (Australia)	Monthly snapshots
Azure DevOps artifacts	28 days (PITR)	Azure DevOps	Pipeline metadata and release artifacts

4.5 AI Processing Data

Data Category	Retention Period	Storage Location	Notes
AI request/response data	Ephemeral (not persisted by provider)	OpenAI API, Anthropic Claude API	Per DPA - not stored by AI providers
AI memory (Mem0)	Duration of subscription	Azure Container Apps (Australia)	Deleted with account
AI audit logs	90 days	Azure Log Analytics	For quality and compliance review

5. Data Disposal Procedures

5.1 Standard Disposal

When data reaches the end of its retention period, the following procedures apply:

1. Database records: Soft-deleted immediately, hard-deleted via scheduled purge job within 30 days
2. Blob storage: Objects deleted and storage reclaimed; Azure handles secure erasure of underlying media
3. Log data: Automatically expired by Azure Log Analytics retention policies
4. Backups: Automatically expired per Azure backup retention configuration

5.2 Customer-Initiated Disposal

When a customer deletes their account or disconnects a client:

1. Customer initiates deletion via XBert product interface (self-service)
2. All associated data is marked for deletion
3. Active database records are purged within 30 days
4. Backup copies are purged as backup retention windows expire (maximum 28 days for PITR, 12 months for long-term)
5. Confirmation of deletion is logged in the audit trail

5.3 Secure Disposal Methods

Media Type	Disposal Method
Azure SQL Database	Logical deletion with Azure-managed secure erasure of underlying storage
Azure Blob Storage	Object deletion with Azure-managed secure erasure
Auth0 user records	API-driven deletion per Auth0 data deletion procedures
Local development data	Secure wipe using platform-appropriate tools
Physical media (if any)	Not applicable - XBert operates entirely in cloud

5.4 Third-Party Data Disposal

For data held by third-party service providers:

Provider	Data Held	Disposal Mechanism
Auth0	User identity and authentication data	Auth0 Management API deletion + Auth0 retention policies
Chargebee	Subscription and billing data	Chargebee API deletion; PCI-DSS compliant disposal
Stripe	Payment processing data	Stripe data deletion API; PCI-DSS Level 1 compliant
OpenAI	Ephemeral processing data	Not persisted per DPA; zero-retention API usage
Anthropic	Ephemeral processing data	Not persisted per DPA; zero-retention API usage

6. Exceptions

Any deviation from the retention schedule requires:

1. Written approval from the CTO
2. Documented business or legal justification
3. A defined expiry date for the exception
4. Entry in the exceptions register

Legal holds or regulatory investigations may require data to be retained beyond the standard retention period. The CTO will coordinate with legal counsel as required.

7. Roles and Responsibilities

Role	Responsibility
CTO	Policy owner; approves exceptions; ensures compliance
Development Manager	Implements and maintains automated retention/disposal mechanisms
Database Administrators	Execute and verify data purge operations
All Staff	Comply with policy; report data handling concerns

8. Compliance

This policy supports compliance with:

• Privacy Act 1988 (Cth) - Australian Privacy Principles (APPs)
• APP 11 - Security of personal information (including disposal)
• GDPR (where applicable to EU/UK customers)
• Contractual obligations to customers regarding data ownership and deletion

9. Monitoring and Review

• Automated alerts for any data retained beyond its scheduled retention period
• Quarterly review of disposal job execution logs
• Annual policy review aligned with security assessment cycle
• Review triggered by significant changes to infrastructure, legislation, or customer contracts

10. Change History

Version	Date	Changes
1.0	April 2026	Initial creation