Data Retention
Effective October 9, 2026
Default sensitive-field period
The current Tribal Verify default is to retain full date of birth and full Nation-issued member numbers for 30 days, then purge those full values. Participating Nations can configure another approved period before live use, including a shorter period where operationally feasible.
What can remain after purge
Tribal Verify may retain the verification ID, Nation, result, verification date, requester organization, consent/audit information, transaction records, and the last four characters of a Nation-issued member number when the Nation permits that limited reference. Tribal Verify does not need to retain a full member-number hash after the sensitive field is purged.
Verification validity
The current default verification-document validity period is 90 days. Nation administrators can configure the period for their Nation. After the period expires, the validation page marks the record expired and a fresh verification should be requested when current status is required.
Private shares
Private business-document and presentation shares retain the recipient email, access/claim metadata, expiration, revocation, and view activity needed to operate and audit the share. Self-destruct mode shortens browser access after first open; revocation can end access earlier.
Billing, payout, security, and legal records
Some records must be retained longer for accounting, fraud prevention, payout reconciliation, dispute handling, security investigations, contract administration, insurance, tax, legal hold, or other legitimate business requirements. Those records should not retain full sensitive citizenship lookup fields unless specifically required.
Nation-specific rules
A participating Nation may require shorter retention, longer retention, immediate deletion, additional records, or other Nation-specific handling. Those requirements are documented before live Nation data is enabled and control where stricter than the general default.
Legal hold
Routine deletion may be paused for a documented security incident, fraud investigation, dispute, court or administrative matter, contractual requirement, accounting obligation, or lawful legal hold. Holds should be limited to the information and duration reasonably necessary.