Data retention
What stays on the endpoint, what leaves and why, the bounds on each store, and how deletion works.
What stays on the endpoint
Raw collected data stays on the Mac, in a sealed local archive. So do the full results behind every answer and the local signed audit log. Recursift reasons where the data lives and forwards findings, not data.
What leaves, and why
| What leaves | Why |
|---|---|
| Heartbeats: version, mode, uptime and a few counts | Presence, and delivery of policy and questions |
| Profile: identity, addresses, settings, counters, posture checks and bounded inventories | The System tab and posture review |
| Compact summaries of escalated and hunt events | The Events tab |
| Signed findings with the few indicators needed for correlation | The Findings tab |
| Answers, at most 4,000 characters and no rows | The conversation you asked for |
| Rows, only when you request the data for an answer | Your explicit request, up to 200 rows per check |
| Detection and gold build results | Jobs and comparisons you started |
If your organization selects remote inference for a question, the question, its conversation history and bounded evidence from the checks it ran are sent through the console to the model provider your organization configured. Local inference sends none of that.
Bounds on the endpoint
| Store | Installed default | Setting |
|---|---|---|
| Local archive | 100,000 rows or 30 days | archive_rows, archive_max_age_s |
| Findings waiting to send | 10,000 or 30 days | findings_outbox_rows, findings_outbox_max_age_s |
| Events waiting to be processed | 10,000 | intake_pending_max |
| Question results | 24 hours or the newest 200 answered questions; up to 500 rows per check | Fixed |
| Audit log | Rotates into signed segments at 128 MiB | Fixed |
Settings live in ~/Library/Application Support/Recursift/native-config.json; restart the service after changing them. Whichever limit is reached first applies. Requesting data does not extend how long the endpoint keeps it.
How long the console keeps data
Events, findings, questions and answers, and detection results are kept until they are deleted. The console keeps only the latest profile and the latest heartbeat fields for each endpoint. Its pages show the newest 200 events, 50 findings and 50 questions. Finished gold build tasks older than 30 days are removed, with a record kept in the gold build audit. Query API jobs, findings and the customer audit chain do not expire.
Deletion
Deleting a conversation deletes its questions and answers. Revoking an endpoint stops its key and deletes nothing. On the Mac, the uninstall steps in Install an endpoint delete everything local. Deleted archive pages are overwritten by the database, but blocks the file system has not reused yet, and backups, can still hold older copies.