Data Retention Statement

Covio answers every "how long do we keep this" question from one place. There are six named categories. Each carries a number of days or an explicit "no expiry", the source the value came from, and — the part that matters — whether the value is ratified or is still a proposal.

The policy in force today is stamped with the version 2026-08-fd2-pending, so any certificate Covio issues under it says on its face that it was issued under an unsettled policy.

"Kept permanently" here means kept by an explicit decision, not kept because nobody chose a number. Covio's own policy object distinguishes the two and does not let a reader guess which is which.

Not settled / not in placeThese are unratified proposals. Covio publishes them as proposals because publishing a proposal as policy would be Covio inventing a legal position on its customers' behalf.

The first two of these gate destruction. Because they are unratified, Covio's software refuses every production purge today and says why. That refusal is deliberate: it is the system declining to destroy customer data under a policy nobody has ratified.

• What that refusal means in practice →

Sixteen tables are declared as retained rather than purged, and every one of them carries a written basis. There is no third state: a table is declared purge or declared retain, and an undeclared table fails Covio's build. Grouped, they are:

• The evidence that the export and the purge happened: the run record, the per-module record, and the certificate. Deleting these would erase the proof of the deletion.
• The append-only ledger of platform actions taken on the account, and the lifecycle row the certificate points at.
• Evidence about Covio's own conduct rather than the customer's business: which Covio staff member opened which screen, the grant that authorised it, and which companies were told about a platform incident.
• Billing records, on the basis of statutory financial record retention.
• Rows that are not any one company's: the plan catalogue, firmware images published for a hardware model, connector builds published for a version, and Covio's certification of what a given TallyPrime version was proven to do.
• The relationship recording which Covio partner onboarded the company — two identifiers and a timestamp, carrying no customer content.

The purge certificate reports what was retained and why, so what survives is on the record rather than merely absent from the deletion counts.

Not settled / not in placeCovio's own review of this area records the finding plainly: a "retain" declaration currently means "forever", with no mechanism to mean anything else. The declaration structure can carry a period as text, but nothing reads it, nothing schedules against it, and no job has ever deleted a retained row.

Concretely: billing records state a period of eight financial years and nothing deletes them at eight years; the support-access and grant records state a basis and no period at all, so they are retained indefinitely by default rather than by decision. Covio is not going to describe that as a retention schedule.

Covio drafted this document from its own systems rather than from a template, so what follows are the points where engineering cannot decide and a lawyer must.

1. 1Are there statutory obligations on Indian factory-compliance records and documents that survive a customer's termination? If so, which record classes and for how long? Everything about compliance records and documents depends on this answer, and the shape of the answer changes what Covio has to build — a hold that survives termination means a purge that deletes part of a table and still issues a truthful certificate, which nothing in the current design does.
2. 2Is 90 days after termination, before a purge is permitted, acceptable?
3. 3Is a 30-day backup age-out an acceptable true-erasure horizon, given a company's data survives in encrypted backups for that window after the purge?
4. 4Must every "retain" declaration carry an enforced period rather than a basis alone? A stated period that nothing enforces is a commitment to delete that is not being kept, which is a different exposure from having no period at all.
5. 5Is indefinite retention of the support-access log and its authorisation record defensible, and does an erasure request reach them? If they must expire, what period?
6. 6Does the Companies Act 2013 s.128(5) eight-financial-year books-of-account period apply to Covio's entity and to its billing records? Covio recorded it as the governing obligation and cannot confirm it.
7. 7Is there an upper bound Covio should place on raw machine telemetry for a live customer?