> ## Documentation Index > Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt > Use this file to discover all available pages before exploring further. # Retention and zero-data retention > Compare standard retention with zero-data retention, including recovery, export, channel reconstruction, deletion, and erasure limits. Retention controls what Checkfu may keep in durable custody. It does not change which system owns execution truth: while content is retained, the Session event log remains the execution record. When content is omitted or erased, Checkfu does not invent a replacement transcript. ## Standard retention compared with ZDR | Behavior | Standard retention | Zero-data retention | | ----------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Session content | May be persisted under Workspace policy | Execution content is omitted from durable custody | | Session event positions | Retained events remain readable; later-expired content can become unavailable | Structural positions or non-content facts may remain, but omitted content is not readable | | Recovery and resume | May use retained events, checkpoints, and recoverable artifacts when the selected runtime supports them | Cannot reconstruct omitted prompts, responses, tool arguments, or observations | | Replay | Can replay the retained event tape structurally; external effects still require reconciliation | Cannot replay omitted execution content | | Session export | Exports readable retained events and identifies unavailable positions | Cannot export content that was never durably kept | | Channel reconstruction | A channel may project retained Session truth when the channel path supports it | Checkfu cannot rebuild omitted channel content after the live delivery path ends | | Audit | Structural governance records may remain | The same non-content governance record may remain | | Usage | Authoritative metering facts may remain | The same non-content metering fact may remain | | Erasure work | Must fence and dispose of retained content across required sinks | Has less execution content in custody, but still has structural records, configuration, external copies, and in-flight work to account for | ZDR is not a stronger recovery mode. It is a reduced-custody mode with fewer recovery, replay, export, and reconstruction semantics. Zero-data-retention managed execution is currently `preview` and `rollout_fenced`. A retention field in a typed request is not proof that the selected runtime, channel, memory, or provider path qualifies. Check the authenticated [capability status](/getting-started/status). The current source row is customer-facing `preview`, `rollout_fenced`, admits only the `zdr` retention mode, and requires the hosted ZDR Runner prerequisite plus release evidence. Those labels describe source posture; the live endpoint must still report `available: true` for the selected deployment and Workspace. ## What may remain without execution content Checkfu can retain non-content facts needed for governance, accounting, and safety, such as: * identifiers and sequence positions; * timestamps and state transitions; * authorization and policy dispositions; * approval identity and decision; * Usage units and monetary facts; * content-unavailable reasons; and * non-secret provider effect disposition. These records are not a transcript. They must not contain raw credentials or reconstruct omitted prompts, responses, tool arguments, file bodies, or screen content. A Principal erasure can remove or anonymize the direct subject link while retaining a non-identifying Usage or Audit fact. Historical Workspace totals do not change merely because the attributed identity was erased. ## Recovery and channels A channel is ingress and presentation around a Session. It does not own a second transcript. Under standard retention, a qualified channel can rebuild presentation from retained Session truth. Under ZDR, content omitted from the Session cannot later be reconstructed by Checkfu. External channel providers can keep their own copies under their own policies. Checkfu's retention mode does not erase provider-held mail, messages, files, or delivery logs unless an admitted provider operation explicitly does so and the result is observed. Plan 814 is in progress. Durable callback acceptance, observation recovery, and fenced presentation reconciliation have landed. Presentation-sink erasure integration and credentialed live-provider qualification remain open, so a retention mode or source adapter still does not establish complete channel custody or provider support. ## Export `GET /v1/sessions/{id}/export` can return only what the caller is authorized to read and what remains in durable custody. The export accounts for unavailable sequence positions rather than fabricating content. An export is a new downstream copy. Once written to your filesystem, object store, SIEM, or data warehouse, it is governed by your retention and erasure controls. A later Checkfu erasure cannot reach that copy. See [Export retained Session and audit records](/guides/export-your-log) for the current export boundaries. ## Deletion and erasure Use the terms precisely: * **Archive** changes lifecycle or mutability while retaining the resource. * **Delete** removes the addressed logical resource according to its typed contract. * **Erase** disposes of protected content and identity links across every sink included in the erasure contract. A successful route response is not enough evidence to claim complete erasure across every sink. Completion requires landed fences for active releases, in-flight exports, caches, channel projections, memory synchronization, snapshots, provider-held copies that Checkfu is responsible for, and every other required custody path. ### Current limitation Current implementation and verification evidence do not establish one linearized erasure fence across every historical execution frame and registered presentation sink. Plan 813 is `IN PROGRESS`: privileged trajectory export, server-derived producer attribution, signed Bundle frontiers, Bundle release/deletion ordering, and a durable Session-owned sink worklist have landed. Current writes are retention-classified and ZDR avoids durable HarnessLoop transcript bytes, but historical dormant custody and the Plan 814 presentation-sink handoff are not fully closed. Remote provider erasure or revocation can also remain pending. Therefore: 1. stop new work and revoke relevant access before requesting erasure; 2. cancel or quarantine in-flight exports and provider operations; 3. treat downstream exports as separately governed copies; 4. retain the Audit evidence for each disposal step; and 5. do not describe erasure as complete until the deployment's current evidence covers every required sink. This limitation is about completion evidence. It does not authorize Checkfu to return content that a live retention check has already made unavailable.