Retention

Documents contain personal data and are deleted when their retention ends. The template sets the rule, tenants can change the months.

Rules

Rule	Counted from
RetentionRule::afterCreation($months)	the creation
RetentionRule::afterSigning($months)	the signature (or finalisation)
RetentionRule::afterAnchor($months)	a date the application sets later, e.g. the exit date of a person

Months must be 1 to 1200.

Anchor dates

With afterAnchor() documents are kept until the application sets the date:

// e.g. in the action that records the exit of a person
$count = service('documents')->startRetention($resource, $person, Time::parse('2026-12-31'));

It sets the start of all documents of the record whose template counts from an anchor, and returns their number. Calling it again moves the date.

Changing the months per tenant

The page Retention of documents (permission documents.retention, from Access::pages()) lists the templates with their rule and months. Changes are audited, and the dates of existing documents are recalculated.

service('documents')->setRetention('issue-receipt', 48);   // the same in code

Deleting

php spark anvil:tick deletes documents whose retention has ended (up to 500 per run), in all tenants:

• the PDF file is deleted,
• the data snapshot and the signer name are cleared,
• the row keeps template, dates and hashes, status purged,
• document.purged is audited.

So it stays traceable that a document existed and was signed, without keeping its content.