Retention, lifecycle, and the right to be forgotten

Lesson 3 of 3 in Data Security and Privacy for GenAI.

A GenAI application is a data-retention problem wearing a chat interface. It accumulates: invocation logs (opt-in, account-level — metadata, prompts, and responses to CloudWatch Logs and/or S3, with bodies over 100 KB or binary going to S3 only), conversation stores, Knowledge Base source documents and their vector embeddings, fine-tuning corpora, and evaluation and red-team transcripts. Every one of those is a copy of customer data with its own clock.

The AIP-C01 exam guide names the mechanism: S3 Lifecycle configurations implement retention as bucket policy — expiration deletes current versions on schedule, noncurrent-version expiration cleans the history versioning keeps, and rules scope by prefix or tag so raw/ can die at 90 days while redacted/ survives seven years in a cheaper tier. CloudWatch Logs groups carry their own per-group retention settings. And because invocation logs land in your bucket under your KMS key, their retention is yours to set — a control, and therefore an obligation.

A transcript’s life, by policy

  1. Captured

    Invocation logging delivers it to your S3 bucket — gzipped JSON, KMS-encrypted, tagged raw/.

  2. Active use

    Eval sampling, drift analysis, audit queries via Athena. Access logged; nobody edits it in place.

  3. Legal hold?

    Retention has a keep-side too: S3 Object Lock holds override deletion until released.

  4. Retained under lock

    WORM retention until the hold lifts — lifecycle rules wait their turn.

  5. Retention clock expired?

    The lifecycle rule for its prefix/tag: e.g. raw/ at 90 days, redacted/ at 7 years.

  6. Lifecycle expiration

    Current version expired, noncurrent versions expired — the versioned history goes too, by rule rather than by script.

  7. Gone — provably

    CloudTrail S3 data events record the deletions: evidence the retention policy executed, not just existed.

Invocation logs and metrics

S3 Lifecycle rules on the logging bucket plus per-log-group retention in CloudWatch Logs. Scope by prefix: raw captures short-lived, redacted derivatives longer. The deletion is itself auditable through CloudTrail data events.

The vector store

Deleting the source PDF from S3 does not delete its chunks and embeddings — the Knowledge Base keeps serving them until the data source is re-synced, which removes vectors for documents that disappeared. Embeddings of personal text are personal data; treat the index as a data store with a deletion path, not a cache.

Conversation memory

Self-managed session stores get a TTL (DynamoDB TTL is the classic pattern) so transcripts age out by default. Whatever holds memory for your agents needs an expiry answer — "forever, implicitly" is the wrong one.

The customized model itself

The one-way door: a fine-tuned model cannot selectively forget one person. If training data must be deletable per-subject, redact or anonymize before training — otherwise honoring a deletion request means retraining without the data and retiring the old model version.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.