Data Retention and Disposal Policy

Last updated: March 24, 2026

1. Purpose

This policy defines how RAVEN retains, archives, and disposes of consumer data processed through our platform. It ensures compliance with applicable laws including the Fair Credit Reporting Act (FCRA), Gramm-Leach-Bliley Act (GLBA), state privacy laws, and contractual obligations to our customers.

2. Data Categories and Retention Periods

Data Category	Examples	Retention Period	Basis
Identity verification data	Name, DOB, SSN match results	7 years from last activity	FCRA, BSA/AML requirements
Credit report data	Scores, tradelines, inquiries	2 years or per source TTL	FCRA permissible purpose records
Financial account data	Bank accounts, balances, transactions	1 year from last enrichment	Service necessity
Employment/income data	Employer, salary, verification reports	3 years from verification date	Lending regulation
Property/residence data	Address, ownership, valuations	3 years from last enrichment	Lending regulation
Education data	Enrollment, degrees	3 years from verification date	FERPA, service necessity
Consent records	User consent timestamps, text hashes	7 years from consent date	Legal compliance, audit
Audit/event logs	Data access logs, enrichment events	7 years	Regulatory examination
API access logs	Tenant API calls, request metadata	2 years	Security, troubleshooting
Session data	Verification sessions, OTP state	24 hours (auto-expired via DynamoDB TTL)	Operational
Form tokens	Verification form links	1 hour (auto-expired via DynamoDB TTL)	Operational

3. Staleness and Data Freshness

All enriched data carries a "goodBy" expiration date determined by the source provider's TTL configuration. After this date:

The data is flagged as stale in our system
Stale data is excluded from materialized views (the current state of a user's profile)
The raw event history is retained for audit purposes per the retention periods above
Customers are notified of stale data via the staleness detection API

4. Encryption

All consumer data is encrypted at rest using AES-256-GCM with per-user Data Encryption Keys (DEKs). DEKs are themselves encrypted using AWS KMS (envelope encryption). Encryption is applied at the field level — each field in each module for each user is independently encrypted.

5. Data Disposal

5.1 Automatic Disposal

Session data and form tokens are automatically deleted via DynamoDB TTL
Stale enrichment data is automatically excluded from active use after its goodBy date

5.2 Customer-Initiated Disposal

Customers may request deletion of a user's data via DELETE /api/v1/users/:id
This removes all module data, events, provider tokens, consent records, and identity lookups for the user
Deletion is permanent and irreversible

5.3 Consumer-Initiated Disposal

Consumers may request deletion of their data by contacting privacy@reportraven.tech
We will verify the consumer's identity before processing the request
Deletion is completed within 30 days of a verified request
Certain data may be retained if required by law (e.g., FCRA dispute records)

5.4 Disposal Method

Data disposal is performed by deleting the encrypted records from DynamoDB. Since data is encrypted with per-user DEKs, destroying the DEK renders all associated data permanently unrecoverable even if database backups exist.

6. Data Portability

Consumers may request an export of their data in machine-readable format (JSON). Requests are processed within 30 days.

7. Contact

For questions about data retention or to submit a deletion/portability request:

Email: privacy@reportraven.tech
Web: reportraven.tech