Skip to content

Private Beta · Data Retention as Code

Delete less at random. Prove more.

RetentionOps turns retention rules into versioned policies, requires independent approvals and signs evidence after every execution.

1c86f533f0515d69

Don’t take our word for it. Check.

A retention policy is text. What makes it executable is its digest: every approval binds to that, not to the file. Change one line below and watch the approval stop applying — that is literally the product’s mechanism, played out here with no server involved.

SHA-256 digest, computed in your browser

1c86f533f0515d6951d8f663dfe2641e606426fe708cffc1f34bf5c74f0375be

This is the digest an approver signed. Execution is authorized.

Nothing was sent anywhere. Save this text and check it yourself:

shasum -a 256 audit-logs-7y.yaml

Seal of the approved policy

Four steps, four identities, four artifacts

No step can do the next one’s job. That is what separates a chain of custody from a Delete button with a confirmation dialog.

  1. Describe

    Version durations, legal holds and safeguards with code.

    Who acts
    Policy author
    What comes out
    Policy digest
  2. Simulate

    A read-only identity calculates impact without permission to mutate the target.

    Who acts
    Read-only identity
    What comes out
    Immutable, encrypted plan
  3. Approve

    Independent roles sign the plan digest before it expires.

    Who acts
    Separate approvers
    What comes out
    Approval bound to the digest
  4. Execute and prove

    A bounded worker deletes in batches and seals the result.

    Who acts
    Connector, on your side
    What comes out
    Signed evidence

Execution happens on your side. Not ours.

RetentionOps does not connect to your databases. A connector you run inside your own network holds the only credentials that can; we send it signed instructions, it sends back signed evidence. That is everything that crosses.


Outbound only, on 443

The connector dials out; it listens for nothing. Your firewall needs no inbound rule, no port forward, and no exception for a vendor address range.


Your credentials never leave

There is no column, no request field and no variable anywhere in the control plane that can hold one of your database hosts or passwords. We cannot connect to them: we do not know where they are.


Counts leave. Rows don’t.

The result schema has no member that could carry a row value. That is not an internal policy, it is a format constraint enforced on both sides.


Read it before you install it

The connector is published under Apache-2.0. Four operations, no SQL on the wire, and a file on your host that decides what we are allowed to touch. “Trust us” is not an argument that survives a security review.

Understand the security boundary


Request access to the closed private beta.

Solutions Optigm inc. opens RetentionOps by invitation only, using synthetic data and without billing, an SLA or general availability.

The deterministic engine stays the execution authority. Billing and quotas may refuse an action, never authorize one.