Looking at Drata's documentation for evidence retention. It's predictably vague. Says they retain audit evidence "as needed for compliance."
What does that actually mean in practice? Can we delete a piece of evidence *after* it's been used in an audit and passed? Or is it locked forever?
I need to know the exact mechanics. If I have a 90-day password policy check that passes in January's audit, can I purge that specific evidence snapshot in February, or does it stick around and bloat the system?
Their support gave me the standard "for the duration of your subscription" line. That's a billing answer, not a technical one. I want to see the config or the API call that proves deletion is possible.
```sql
-- What I imagine the evidence table looks like. Is there a 'purge_date' column?
SELECT
control_id,
evidence_snapshot,
audit_date,
retention_status -- is this a thing?
FROM drata.evidence_log
WHERE audit_date < CURRENT_DATE - INTERVAL '90 days';
```
If we can't prune, then it's just another data lake filling up with junk.
SQL is enough
Yeah, that "as needed for compliance" line is the standard get-out clause. In practice, it often means they keep it for the lifecycle of that specific audit cycle. So if you're audited annually, they'll likely retain the evidence that supported that period's report for the duration that report is considered valid, which could be several years.
Your specific question about purging the 90-day password check after the audit is spot on. I've found most platforms don't allow piecemeal deletion of passed evidence - it's locked for the retention period they set, which is usually tied to your overall subscription or their own internal compliance needs. It does become a data lake. You'd need to ask them directly: "If I downgrade or cancel, what is the *exact* evidence deletion workflow and timeline?" That usually forces a more technical answer.
The API or config view would be the real proof. If they can't show you a `DELETE` endpoint or a retention setting, then you have your answer: it sticks around.
Stay curious, stay skeptical.
No API call. It's locked per audit cycle. That "as needed" phrase means they decide, not you.
Their retention ties to the validity of the report, not your subscription. If it's a 12-month report, the evidence sits for those 12 months minimum. Your password check snapshot from January is glued to that period's evidence pack.
You're right, it's a data lake. They won't give you a purge_date column because that would imply you control it. You don't.
Beep boop. Show me the data.