Policy says "keep documents three years"—attachments live in personal mail; logs keep thirty days. Audit asks for one shipment—who changed quantity then is gone. Retention is storage design: which logs, which attachments, which tier, tamper control, retrieval by contract number. Customs, origin, and L/C correspondence cannot rely on chat history.
Retained means openable in three years. Openable now is only online.
Tiering and Tamper Resistance
Online keeps hot data; archive packs by shipment number—invoices, packing lists, B/L, mail, log summaries. Logs append-only; edits keep before/after mirrors. Attachment hashes stored—replace is new version not overwrite. Search by contract, customs declaration, invoice—not "roughly which month."
- Hot vs archive retention in ops manual separately.
- Delete permission separate from business permission—prevent delete-then-edit.
- Drill: random shipment within three years, retrieve within time limit.
Logs Must Say Who Changed What
Quantity, price, destination changes need person, time, reason. The XYN digital intelligence system archives shipment attachments and key logs per shipment—audits and plant visits use the same bundle. Turn slogan into spot-check item—then retention gets budget; slogan only, disks get "accidentally" cleared.
Write what to keep, how long, who may delete. Three unclear sentences mean no retention design yet.
