Retention & isolation

Raw payment proof is disposable. Verdicts and fingerprints are durable. Untrusted files never run on the API host.

Edit policy

Raw file lifetime

24h

Hard delete, no archive

Verdict history

90d

Then aggregated only

Off-site copies

Single region, no replication

PDF sandbox

Docker

Unprivileged, no network

Data lifecycle

Each stage has a fixed maximum and an audit entry.

Policy v2.0

T+0

Receive

Raw file written to an encrypted bucket with a random object key.

T+2s

Fingerprint

SHA-256 and perceptual hash stored. OCR fields extracted in memory.

T+2s

Decide

Verdict stored without the file. The response links to the check row.

T+24h

Purge

Object overwritten and pointer removed by the retention worker.

T+90d

Aggregate

Check detail is rolled into seller-level counts and fraud trends.

T+7y

Incident hold

Confirmed fraud cases keep metadata only, never the raw document.

Sandboxed parsing

PDFs are the highest-risk upload. They are opened outside the API process.

Unprivileged containerRuns as UID 65534 with a read-only root filesystem.

Network disabledNo egress from the parser container.

5 second CPU limitKilled if parsing exceeds the budget.

256 MB memory capPrevents decompression bombs.

No shell in imageDistroless base with only the parser binary.

Parsing failures are returned as 422 unreadable_document and never reach OCR.

Purge policy

Applies to every file, regardless of verdict.

Raw file lifetime

Worker interval

Deletion method Object storage versioning must remain disabled for overwrite to be effective.

Flagged holds

Changes are audited.

Purge log

Proof that deletion actually ran. Every row includes the object key and result.

Worker healthy

Run	Started	Scanned	Deleted	Failed	Duration	Result
PRG-4412	Today 10:15	8	8	0	1.4s	Complete
PRG-4411	Today 10:00	11	11	0	1.9s	Complete
PRG-4410	Today 09:45	9	9	0	1.2s	Complete
PRG-4409	Today 09:30	7	7	0	1.1s	Complete
PRG-4408	Today 09:15	12	11	1	2.6s	Retried
PRG-4407	Today 09:00	9	9	0	1.5s	Complete

Last 6 runs · 100% of scheduled deletions executed Retention worker runs every 15 minutes.