Standard retention preserves the review record
Standard retention keeps the submitted subject, original result, and versions so the team can review them later. Analyst decisions are added while evidence remains available. New paid workspaces default to 10 calendar years. Existing workspaces keep their configured day-based policy.
An authorized administrator can choose 1 to 10 calendar years or 1 to 3,650 days. An open standard-retention case protects evidence that is still available until review is complete. The case saves the retention policy used when it was created.
With review_completed, the retention period starts when the case closes. With relationship_ended or business_event, an administrator must record the dated event and a reason. The period starts at whichever is later: review closure or that recorded event.
A null expiresAt does not always mean the evidence is permanent. The case may still be open, an event may not have been recorded, or an indefinite hold may apply. Read the case retention controls to find the reason. A later policy change cannot recover expired records or restore inputs that were not retained.
When evidence expires, maintenance clears eligible subject, request, result, and case-note content. Basic tombstone and usage facts can remain for consistency. Open-case protection cannot rebuild evidence that expired earlier. Export required records while they are available.
Make retained-data behavior part of the client contract
The create result and retained detail response are different projections. Standard evidence preserves the submitted subject and request while available. Minimal-mode create responses can contain submitted values in match explanations, but subsequent GET /results/{id} returns subject:null and reference:null, and the evidence download returns request:null and retainedInputs:false.
Use the evidence document’s expires_at and the case governance resource to understand retention protection. expires_at:null does not mean a permanent archive: open review, an unrecorded event trigger or an indefinite hold can each explain it. Your application’s own copies need a separate retention and deletion policy.
Treat 410 result_expired as an explicit unavailable state. Never reconstruct historical evidence from a saved counterparty, a current source version or a request digest. A new screening uses new time/versions and is a new operation with a new idempotency key; link it as a replacement rather than overwriting the old record.
Holding, releasing a hold and recording a retention event require an authorized human administrator. Read case governance and export while data remains available; API-key access to retained evidence does not give the integration permission to override preservation controls.
Put a hold on evidence that must be kept
An owner or administrator can hold case evidence until a date or indefinitely. The evidence must still be available. Each hold has an ID and a reason. To release it, supply holdId and a release reason. Other active holds still apply; a hold cannot bring expired data back.
GET /api/v1/reports/cases/{id}/governance shows the retention trigger, recorded event, holds, and external document links. An authorized person uses the dashboard to hold or release evidence and record retention events. Your organization chooses a retention policy that fits its business and obligations.
Minimal mode reduces what the server keeps
An individual API-key screening can request retention: minimal when organization and policy rules do not require retained review, external checks, or retention tied to a business event. Otherwise the API returns standard_retention_required. An accepted minimal request does not create a review case. Dashboard checks, batches, and monitors use standard retention.
Minimal mode does not retain the submitted subject or request. Submitted values are removed from saved match explanations. A reduced result and source facts remain for 24 hours. The immediate response may still include submitted values, so control what your own application stores and logs.
The saved request digest helps detect duplicates. It does not prove the data is anonymous or make the record tamper-proof. Once required inputs are gone, you cannot fully replay the historical screening, even if the source snapshot still exists.
Monitoring and backups need separate treatment
Active monitoring retains its subject until stopped and deleted. Bulk screening uploads expire after 24 hours; supporting text attachments follow case evidence retention. Webhook delivery history expires after 90 days; audit events after 365 days. Failed private-object deletion is retried. Original source versions remain subject to approved source-retention rules and retained evidence references.
Original PDFs, images, and passport scans remain in your organization’s document service. SanctionsKit retains their links and reviewer assertions, not the original files. Case retention and holds do not preserve or change the originals; manage their access and retention in that service.
Provider backups follow a separate configured expiry window. Deleting a current row is not a promise of immediate deletion from every backup. Confirm the backup window, source rights, legal holds, and restoration procedure with the operator’s approved privacy policy.
Frequently asked questions
When does the case evidence retention period start?
With review_completed, it starts when the review closes. For relationship_ended or business_event, an administrator records the dated event and a reason. The period then starts at the later of case closure and that event. Read the case’s saved policy and controls for its actual rule.
Does a null expiresAt mean the evidence will stay forever?
No. It can mean an open review, a retention event that has not been recorded, or an indefinite hold. Read case governance to see the reason. Your own exported copies need their own retention and deletion rules.
Can I release one evidence hold while another still applies?
Yes. Each hold has its own identifier. Release the intended hold using holdId and a reason. Other active holds remain in force. Holds protect evidence that is still available and cannot restore data that already expired.
Does a case hold preserve original files in our document service?
No. SanctionsKit retains the document reference and reviewer assertions, not the original PDF, image, or passport scan. Manage access and retention in that service separately. A case hold or export does not copy or preserve those external originals.
KEEP BUILDING