Retention & Lifecycle

Why lifecycle matters for compliance

A workspace that should have been deleted three years ago is a compliance liability today. GDPR data-minimization principles require that personal data is not retained beyond its purpose. Sector-specific frameworks (financial services, healthcare) require explicit retention schedules. Internal data governance policies typically require that workspaces unused for N months be archived or deleted. Without automation, the workspace stays forever.

Workspace lifecycle automation turns the policy into operation. Inactivity detection identifies candidates; renewal flows give owners the chance to retain; archival and deletion automations handle the cases where renewal does not happen. The audit log captures every step.

How the phases compose

Provisioning establishes the workspace with the appropriate template (naming, metadata, retention tag). Inactivity detection runs on a schedule, workspaces with no recent activity surface as renewal candidates. Renewal asks the owner to attest or extend. Archival moves workspaces out of active scope while preserving content. Deletion permanently removes the workspace after retention expires.

Each phase has hooks for custom logic, notifications to specific stakeholders, escalation to admins when owners are unavailable, custom retention overrides for legal hold scenarios.

Retention of governance data

Beyond workspace lifecycle, Rencore retains its own data, audit logs, evidence packs, inventory snapshots, policy version history. Each category has a configurable retention period. Defaults align to SOC 2 (1-3 years) and ISO 27001 expectations; legal hold flags exempt specific records from automatic deletion when litigation or audit demands.