Legal hold and export

Legal hold on one element or on everything

While a hold is active nothing under it can be tossed or discarded, even after the clock lapsed

Depends on: LEGAL-0001

Legal hold release needs a typed confirmation

A hold is lifted only by typing RELEASE and its number, and both placing and releasing are written to the audit

Depends on: LEGAL-0001

Export before delete for tax-relevant data

Tax-relevant data can only be tossed after an export in an open format (JSON lines) was written to a folder the person chose

Depends on: LEGAL-0001

Spanish acknowledgement before a toss

The person must be shown and accept the Spanish acknowledgement text; the SHA-256 of the text is recorded; the English translation is a courtesy and is not accepted for a toss

Depends on: LEGAL-0001

English courtesy translation of the acknowledgement

English text of the acknowledgement, clearly marked as a translation, for people who read English

Depends on: LEGAL-0001

Tamper-evident removal audit

Every removal choice, refusal, keep, toss, discard, hold, liquidation and table import is written to an append-only hash chain; update and delete are blocked by triggers

Depends on: LEGAL-0001

Removal audit verification and state cross-check

The chain is re-computed and the holds, agent flag, liquidation and retention table are compared with what the audit says; any difference blocks every delete until repaired from a backup

Depends on: LEGAL-0001

Audit head hash kept outside the database

The head hash of the audit can be printed or saved with backups so that a truncated or rewritten chain can be noticed; planned

Depends on: LEGAL-0001

Audit limits statement

The audit is tamper-evident against accidental or casual edits, not against a determined administrator who recomputes the whole chain; this limit is stated in the app and the docs

Depends on: LEGAL-0001