Private Beta · Data Retention as Code
Delete less at random. Prove more.
RetentionOps turns retention rules into versioned policies, requires independent approvals and signs evidence after every execution.
Don’t take our word for it. Check.
A retention policy is text. What makes it executable is its digest: every approval binds to that, not to the file. Change one line below and watch the approval stop applying — that is literally the product’s mechanism, played out here with no server involved.
SHA-256 digest, computed in your browser
1c86f533f0515d6951d8f663dfe2641e606426fe708cffc1f34bf5c74f0375be
This is the digest an approver signed. Execution is authorized.
Nothing was sent anywhere. Save this text and check it yourself:
shasum -a 256 audit-logs-7y.yaml
Four steps, four identities, four artifacts
No step can do the next one’s job. That is what separates a chain of custody from a Delete button with a confirmation dialog.
Describe
Version durations, legal holds and safeguards with code.
- Who acts
- Policy author
- What comes out
- Policy digest
Simulate
A read-only identity calculates impact without permission to mutate the target.
- Who acts
- Read-only identity
- What comes out
- Immutable, encrypted plan
Approve
Independent roles sign the plan digest before it expires.
- Who acts
- Separate approvers
- What comes out
- Approval bound to the digest
Execute and prove
A bounded worker deletes in batches and seals the result.
- Who acts
- Connector, on your side
- What comes out
- Signed evidence
Execution happens on your side. Not ours.
RetentionOps does not connect to your databases. A connector you run inside your own network holds the only credentials that can; we send it signed instructions, it sends back signed evidence. That is everything that crosses.
Outbound only, on 443
The connector dials out; it listens for nothing. Your firewall needs no inbound rule, no port forward, and no exception for a vendor address range.
Your credentials never leave
There is no column, no request field and no variable anywhere in the control plane that can hold one of your database hosts or passwords. We cannot connect to them: we do not know where they are.
Counts leave. Rows don’t.
The result schema has no member that could carry a row value. That is not an internal policy, it is a format constraint enforced on both sides.
Read it before you install it
The connector is published under Apache-2.0. Four operations, no SQL on the wire, and a file on your host that decides what we are allowed to touch. “Trust us” is not an argument that survives a security review.
Request access to the closed private beta.
Solutions Optigm inc. opens RetentionOps by invitation only, using synthetic data and without billing, an SLA or general availability.
The deterministic engine stays the execution authority. Billing and quotas may refuse an action, never authorize one.