Retention and legal holds

Stratl never deletes a record itself. Its permission on storage is write and read, storage keeps every version, and deletion is a human act. Retention and holds exist to decide what that human is allowed to touch, and the Stratl API is the only place that answers the question.

The retention policy

Each workspace has one policy: keep records for a number of days after the decision, or indefinitely. The default is indefinitely, which means nothing is ever eligible for deletion until an owner or admin sets a period. Set it on the Custody page (Retention and legal holds → Edit policy) with an optional note every member sees, for example Seven years, per records schedule R-12.

Retention runs from the time of the decision, not from the time Stratl received it. Shortening the policy never removes anything; it only changes what is reported as eligible.

What every record reports

Next to every record, Stratl reports where it stands:

State	Meaning	Deletable?
retained	Inside the policy window; the expiry date is shown	No
past retention	The window has passed and no hold applies	Yes
indefinite	No policy is set	No
on hold	A legal hold covers it	No

GET /v1/retention/eligible lists the records a deletion process may remove today. That list is the whole contract: anything not on it stays. The Custody page shows the counts.

Legal holds

A hold is placed on one decision or on a subject. A subject hold covers every record about that person or thing, including records that arrive after the hold, and including Stratl’s own workflow records about them. While a hold is active, nothing it covers is deletable, whatever the policy says.

Placing a hold asks for a reason (a matter, a request, a case reference), the name of the person placing it and, optionally, their authority. It writes a signed record into the stream (legal_hold.place), linked to the decision or the subject. Lifting it asks for a reason and a name too, and writes another (legal_hold.lift). Both records are in the same chain as the evidence they protect, so the hold’s own history verifies offline like everything else.

Only owners and admins can place or lift holds; everyone can see them. The decision page’s Custody card shows the hold on a record (or that it is held through its subject, with a link), the subject page shows it in At a glance, and the Custody page lists every active hold in the workspace.

The record’s own retention block

A source may write a retention block into the record it sends, declaring a policy id, a hold-until date or a legal-hold flag. That is the source’s statement, it is part of the signed record, and it cannot be changed. Stratl shows it separately as source declared. The workspace policy and holds described on this page are what actually govern deletion, and they live outside the record so that they can change without touching the evidence.

What Stratl does not do

It does not delete records, expire them automatically, or move them. When you delete a workspace, a person at Stratl carries out the deletion of the records the policy allows, and a hold blocks the rest. Storage-level retention locks (S3 Object Lock, a Cloud Storage retention policy, an Azure immutability policy), where set, are a separate control that even a human cannot override until they expire.