dxAuth Retention and Deletion
Retention and deletion framework for challenges, auth codes, email jobs, audit logs, and suppression records.
Operational retention model
- 1.1
Login challenges expire quickly. Request tokens and auth codes are one-time and short-lived. Email jobs are retained only as long as operationally useful.
- 1.2
Audit logs, abuse events, suppression records, and admin/session records are retained according to operational, security, and legal needs.
Record categories
- 2.1
App configuration remains while the application is active. Client secrets are stored only in protected hashed form after one-time display. Email suppressions remain while needed to prevent unwanted or abusive delivery.
- 2.2
Backups, if used, may retain deleted data for a limited recovery period.
Deletion and legal holds
- 3.1
Expired challenges, exchanged or expired auth codes, and old email jobs may be removed by scheduled cleanup jobs.
- 3.2
Deletion may be delayed for legal obligations, abuse investigation, security investigation, dispute resolution, backup recovery windows, or service integrity.
Operational verification
- 4.1
Automated tests verify challenge expiry, auth-code exchange and replay denial, suppression behavior, and several audit/security paths. Cleanup deletion assertions still need dedicated production-like verification before claiming retention automation is fully verified end to end.
Requests
- 5.1
Privacy and deletion requests may be sent to privacy@doxanh.dev.