Data Retention Schedule

Status: living document. Reviewed at least annually.

About this document. This schedule transparently sets out

exactly what DevAcademia preserves and for how long, so

institutions can confirm our practices align with their own

records-management requirements. It is reviewed periodically and

updated as our services and applicable law evolve. Retention

windows may be adjusted by agreement with an institution.

Purpose: enumerates how long DevAcademia keeps each category of data it stores on behalf of subscribing institutions, so district counsel and data-protection officers can verify that our default behavior aligns with FERPA § 99.31 purpose-limitation and data-minimization requirements, and with the GDPR storage- limitation principle (Article 5(1)(e)).

Legal basis (US, FERPA): 34 CFR Part 99 does not itself prescribe retention windows for education records — institutions determine those under their own records-management policies. As a "school official" under the § 99.31(a)(1)(i)(B) exception, DevAcademia:

1. Does not retain records longer than needed to provide the

education service.

1. Honors any explicit retention window supplied by the

institution (via written direction or contract).

1. Never auto-deletes education records the institution itself

would retain (submissions, grades, assignments, audit history).

1. Publishes this schedule so institutions can verify (1) and (3)

match their expectations before signing.

Legal basis (EU/EEA/UK, GDPR): Article 5(1)(e) requires that personal data be kept no longer than necessary. DevAcademia acts as a processor; the institution (controller) sets the retention policy, and DevAcademia enforces the windows below by default.

#Retention principles

DevAcademia's storage falls into four categories with distinct retention behavior:

#Per-category retention

#1. Education records (institution-controlled)

DevAcademia never sells, rents, or uses education records for any purpose other than delivering the service the institution authorizes.

#2. Compliance audit trail (never auto-pruned)

FERPA § 99.32(a)(3) recommendation: institutions should retain the DevAcademia audit trail for at least 7 years to match the outer bound of typical FERPA audit-log expectations. DevAcademia never auto-shortens this window.

#3. Operational data (DevAcademia-managed, auto-removed)

Each of the following has a default retention window that the institution can override by contract if a shorter or longer window is required.

#4. Ephemeral credentials (short-lived by design)

Institutions have no override on these — they are cryptographic lifecycle mechanisms, not education records.

#Institution override mechanism

An institution wanting a different retention window on any operational category above:

1. Names the category and desired window in a contract addendum.
2. DevAcademia applies the new window to that institution's data.
3. The change is recorded in the compliance audit trail.
4. Every subsequent annual audit surfaces the override on the

institution's compliance dashboard.

Education records and the compliance audit trail cannot be shortened below their default behavior — that would create a FERPA § 99.32(a)(3) audit-log gap. An institution CAN direct the deletion of specific records (for example under a right-to-erasure request, or on contract termination). An institution CANNOT reduce the general retention window below what FERPA audit-log expectations require.

#Deletion vs archival

Two distinct workflows.

Automatic removal (operational data and ephemeral credentials):

• The record is permanently removed from the live database.
• No archival copy is retained.
• Rolling backups (7-day window) may contain the record for up to

7 days after removal.

• No recovery is possible after the backup window expires.

Institution-directed deletion (education records and audit trail):

• A support request documents the instruction and the

institution's authority.

• DevAcademia performs the deletion.
• The compliance audit trail records the deletion (record type,

count, and originating request) as proof it happened.

• Rolling backups (7-day window) may contain the record for up to

7 days.

• The deletion record itself is preserved for at least 7 years

even though the underlying data is gone.

Contract-termination deletion:

• Within 60 days of termination: a complete export is delivered to

the institution in a machine-readable format.

• Within 90 days of termination: all education records and

memberships are permanently deleted.

• The compliance audit trail is retained for 7 years post-

termination as proof of compliance with the data-return-and- deletion clause of the Data Processing Agreement.

• Backups roll off within 7 days of the 90-day deletion.

#Audit-trail preservation commitment

Under no circumstance does DevAcademia automatically delete the compliance audit trail. No scheduled job removes it. The only way audit records are removed is an institution-directed deletion, which is itself recorded in the audit trail before it occurs — so the fact of the deletion is always preserved.

#Contact

Questions about this schedule, or a request to change a retention window for your institution, go to compliance@devacademia.com.

#Change history