Compliance
Retention
Compliance document
Retention
(English original)
Last reviewed: 2026-10-20 · Version: 1.3
The customer is the controller and sets the retention periods for its own data. The product stores everything in the customer's own tenant, so those periods are applied there. The customer's own country sets some minimums that must be followed, above all its bookkeeping law's minimum retention periods for accounting records, and its conditions for keeping those records in another country — for example Germany's HGB § 257 and AO § 147, or Norway's bokføringsloven and bokføringsforskriften. Each country's rules, with their official sources, are on its page in our country notes, sent on request. The install template defaults to an Azure region in Norway.
What the product keeps, and for how long
| Data | Where | Kept | Notes |
|---|---|---|---|
| Data in the connected source systems | Each source system | Under the customer's policy for that system | Fundarem does not change it except through an approved proposal |
| Ontology objects (the model of the business) | The database in the customer's tenant | Until the customer deletes it | Kept up to date by syncing from the source systems |
| Object history | The database in the customer's tenant | Append-only | The application cannot change or delete a history row; removal is an administrator task in the customer's database |
| Proposals and their decisions | Customer's tenant | Kept for audit | Who proposed, who approved, the outcome |
| Tool-call audit | Customer's tenant | Kept for audit | Parameters and a hash of the output, never the output |
| Fault log | Customer's tenant | Kept for operations | A short reason only; no prompt, message or personal data |
| Pseudonym map | Customer's tenant | While the tenant exists | Keyed hashes only, never raw values |
| Assistant threads and memories | Customer's tenant | Until deleted | Stored pseudonymised |
| AI model calls | Customer's tenant (Azure AI Foundry) | Not kept by us | The model keeps no state between calls |
| Public website request logs | Hosting provider (see Sub-processors) | Per the provider's terms | Demo only |
Retention in practice
Retention periods are set by the customer and applied by the customer's administrator, with our help.