# Retention, holds and redaction
URL: /security/retention
Decide how long originals and reports are kept, keep held runs out of every deletion and strip coordinates and secrets before evidence travels. Deletion comes with a certificate that lists each hash.
Retention decides when Foxborne deletes evidence, and a legal hold decides what it never deletes. Redaction decides what never travels: positions in exported reports, and secrets in journal lines before they leave the vehicle. An admin sets all three in **Settings**, and every change is recorded in the audit log.
## Before you start [#before-you-start]
* You need the **Admin** role.
* You have your program's retention schedule.
* You can see how the storage under the originals is locked. In AWS, that is the Object Lock setting of the originals bucket.
## Retention settings [#retention-settings]
Go to **Settings** and find **Retention**.
| Setting | Choices | What it means |
| -------------------------- | ------------------------------------------------ | ------------------------------------------------- |
| **Original files** | 30 days, 1 year, 2 years or 7 years after import | Deleted with a certificate that lists each hash |
| **Events and notes** | Same as originals | Kept as long as the originals they came from |
| **Reports and case files** | 1 year, 5 years or 10 years | How long exported reports and case files are kept |
| **Legal holds** | A count of runs on hold | Held runs are never deleted, whatever the policy |
Deletion is scheduled, with a deletion certificate per run that lists each hash. A run deleted under the policy opens as **This run does not exist**, with the line **It may have been deleted under the retention policy.**
## Change retention [#change-retention]
Select **Edit** on **Original files** or on **Reports and case files**. Both open the **Retention** dialog, which notes **Shortening retention does not delete anything on hold.**
Choose a period for **Original files** and one for **Reports and case files**. Events and notes follow the originals.
Select **Save**. The console confirms **Retention saved**. The audit log records **Changed retention** on **Settings**, with the originals period as the detail, such as **2 years after import**.
## Legal holds [#legal-holds]
**Legal holds** reads **Held runs are never deleted, whatever the policy**, with a count such as **2 runs on hold**. A hold outranks every retention setting, and shortening retention never deletes anything on hold.
## Match the write-once lock [#match-the-write-once-lock]
Retention in **Settings** decides when Foxborne deletes an original. The storage under the originals decides whether anything can delete it at all.
In the example deployment, the originals bucket uses S3 Object Lock in compliance mode. The **Retention** column on **Hosting** reports **Object Lock, compliance mode, 7 years** for **Original files**, with the note **Written once. Foxborne cannot modify or delete an original.**
In compliance mode, S3 refuses to delete or overwrite a locked object version before its retention date, whoever asks. The lock and the setting live in different places, so keep them in step:
| When | What happens |
| --------------------------------------- | ------------------------------------------------------------------------------------- |
| The lock outlasts the retention setting | Storage refuses the deletion until the lock expires, so originals outlive your policy |
| The retention setting outlasts the lock | Originals stay as long as your policy says, but write-once protection ends first |
| The two match | Originals stay write-once for as long as you keep them |
In the example, the lock runs 7 years, so the matching setting is **7 years after import**. Check both after every change to either one.
## Redaction [#redaction]
### Coordinates on export [#coordinates-on-export]
**Remove coordinates on export** reads **Positions are removed from exported reports unless the exporter turns them back on.** The switch applies at once. The audit log records each change as **Changed redaction** on **Settings**.
| Switch | The console confirms | Audit detail |
| ------ | ----------------------------------------- | ---------------------------------- |
| On | **Coordinates will be removed on export** | **Coordinates on export: removed** |
| Off | **Coordinates will be kept on export** | **Coordinates on export: kept** |
With the policy on:
* The **Export** dialog opens with **Remove coordinates** ticked: **From derived files and the case file. Originals stay byte-identical, so they keep theirs.**
* The report's **Location** line reads **Removed on export**.
* The report's **Before you export** checklist shows **Coordinates are removed on export**. When positions will go out, it warns **Coordinates will be included on export** instead.
* The export's audit entry ends with **coordinates removed**.
### Patterns removed from logs [#patterns-removed-from-logs]
**Patterns removed from logs** reads **Applied on the vehicle before upload**. The example lists **AWS access keys**, **Bearer tokens**, **Passwords in URLs** and **Internal hostnames matching** `*.hfr.internal`.
Select **Edit** on **Patterns removed from logs**. The dialog notes **One per line. Matches are replaced with `[redacted]` on the vehicle, before upload.**
Write one pattern per line. Blank lines are dropped.
Select **Save**. The console confirms **Saved**, and the audit log records **Changed redaction** with the number of patterns, such as **4 patterns**.
Matches never leave the vehicle. The collector replaces them before upload, so the original Foxborne stores already reads `[redacted]` where a match was. A journal exported by hand and brought in through **Import files** has not passed through the collector.
### Process arguments and environment [#process-arguments-and-environment]
**Process arguments and environment** reads **Never collected**. The collector's own list of what it never collects adds camera frames.
### Expressions in the collector policy [#expressions-in-the-collector-policy]
The collector policy holds the expressions the collector matches in journal lines, under **Redact from journal lines**. The example policy holds `AKIA[0-9A-Z]{16}`, which matches AWS access key IDs, and `Bearer [A-Za-z0-9._-]+`, which matches bearer tokens.
Change them in [Set the collector policy](/collect/collector/policy). Vehicles pick up a saved policy at their next check-in.
## Check the result [#check-the-result]
* **Retention** in **Settings** shows the new periods, and the audit log has a **Changed retention** entry.
* The **Retention** column on **Hosting** and the **Original files** setting name the same period.
* The **Export** dialog opens with **Remove coordinates** ticked, and the report's **Location** reads **Removed on export**.
## Troubleshoot [#troubleshoot]
**A run survived a shorter retention.** It may be on hold, since shortening retention does not delete anything on hold. Otherwise, the storage lock on its originals has not expired.
**An export carried positions.** The exporter cleared **Remove coordinates**, or the policy is off. The export's audit entry ends with **coordinates removed** only when positions were removed.
**A secret appears in a journal line.** No pattern matched it, or the journal came in by hand and never passed through the collector. Add a pattern in **Settings** and an expression in the collector policy to cover later uploads. Lines already uploaded stay as they arrived, because originals are write-once.
## Next [#next]
* [Set the collector policy](/collect/collector/policy) holds the expressions the collector redacts.
* [Export a case file](/investigate/export) shows coordinate removal at export.
* [Encryption and keys](/security/keys) covers the key that encrypts every store.