> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.aiplanet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data retention and privacy

> What the gateway stores, for how long, and how payload capture and redaction work.

The gateway database is metadata-only by default. Explicit `data_governance.payload_storage: enabled` retains bounded, credential-redacted request and response content so authorized operators can inspect one exchange through the console or Admin API.

For approved local troubleshooting, independent `payload_logging.enabled: true` emits bounded request, response, error, and streaming-chunk JSON events to stdout. Either destination can be enabled alone or both can be enabled. Credential-bearing fields and recognizable gateway token strings are redacted, but ordinary application content remains sensitive.

Restart the gateway after changing either setting. Filter local or container stdout for `"event":"llm_payload"`. With database capture enabled, use **Overview → Recent requests → View** or `GET /admin/requests/{request_id}`. The list endpoint exposes availability flags without embedding bodies, and tenant-scoped authorization applies to detail reads.

It stores operational metadata such as tenant/application/key identifiers, request ID, route, model/provider, status, token counts, estimated cost, latency, and timestamps. Defaults are 30 days for request metadata and 365 days for administrator audit events:

```yaml theme={null}
data_governance:
  payload_storage: disabled
  payload_retention_days: 30
  request_metadata_retention_days: 30
  admin_audit_retention_days: 365
  budget_ledger_retention_days: 365
  signal_notification_retention_days: 365
  interval_seconds: 3600
  lease_seconds: 300
  batch_size: 1000

payload_logging:
  enabled: false
  max_chars: 65536
```

A Postgres-leased worker clears payload columns after `payload_retention_days`, deletes request metadata, audit events, delivered signal notifications, and finalized budget-ledger entries after their schedules, and clears expired administrator sessions, OIDC login transactions, Platform handoff identifiers, and prior key-rotation hashes. Reserved budget entries are never removed before reconciliation. Inspect policy, lease, last completion, counts, and error through `GET /admin/data-governance`. Administrators can trigger `POST /admin/data-governance/retention/run`; the action and automatic changes are audited. Worker failure degrades `/ready` as `data_retention_ready: false`.

Set `budget_ledger_retention_days` to the contractual or legal minimum required by the deployment. Per-request `settled`/`released` rows expire after that window; budget-period aggregates, alerts, keys, identities, and catalog state remain until the tenant/account lifecycle removes them. Export and deletion requests require an authorized operator procedure, including financial/legal-hold review and backup-expiry handling. Provider-side payload processing and retention remain governed by your provider agreement.