Recording retention and legal hold

Session recordings are kept for the period set in the PAM settings and then purged. A legal hold stops one specific recording from being purged, for example during an investigation.

How does normal retention work?

• The period is the «Recording retention (days)» under «PAM» › «PAM settings» (30 to 3650).
• The recording shows «Kept until 31/12/2027, then purged.»
• Every 5 minutes, a process purges recordings whose period ended and that are not on legal hold. The state becomes «Being purged» and then «Purged».
• Once purged: «The recording was erased: its media can no longer be read.» The digests and the anchor in the audit chain stay, so the audit remains verifiable.

Recordings sit in storage with object lock: not even an administrator can delete them before the period ends.

Placing a legal hold

1. Under «PAM» › «Sessions», open the session.
2. Choose «Place legal hold».
3. The recording shows «On legal hold: never purged, kept by privacy erasure.»

Releasing a legal hold

«Release legal hold» is always four-eyes: it waits for a second administrator under «Dual control». Afterwards the recording returns to the normal period.

And GDPR requests?

An erasure of personal data destroys the key of the person's recordings that are not on legal hold, making them unreadable, cancels their requests and revokes their leases and SSH keys; recordings on legal hold are kept. Your organization decides the legal basis and the period with its lawyer.