28. German legal-tech retention (Legal Team)
Per-prefix WORM policies and row/object-scoped retention holds for tenants subject to §50 BRAO, §257 HGB, or §147 AO.
Why this exists
German professional-services firms — law firms in particular — have to keep specific record classes for years under statute, and cannot delete them on a DSAR erasure request during that window. The three common bases:
- §50 BRAO (Federal Lawyers' Act) — client files retained 6 years from case end.
- §257 HGB (Commercial Code) — split by record class: books, inventories, opening balance sheets, annual accounts, and invoices (Buchungsbelege) retained 10 years; received / sent commercial letters (Handelsbriefe) retained 6 years.
- §147 AO (Fiscal Code) — same split, mirroring §257 HGB: 10 years for books and accounting records, 6 years for other tax-relevant business correspondence.
On Free / Pro / plain Team, retention is defence-in-depth (soft delete + audit log) but not statutorily
enforced. Legal Team makes retention WORM-enforced at the storage layer — even a compromised
admin key can't delete a locked object before its retention date. That's what German auditors and clients
subject to MaRisk AT 7.2 want to see.
What Legal Team unlocks
- Default per-prefix policies. Every object under
/invoices/*is retained 10 years under §257 HGB, WORM-enforced by S3 Object Lock. Additional prefixes (/client-files/*for §50 BRAO,/tax/*for §147 AO) configured per project. - Ad-hoc retention holds. When a customer cites a legal basis mid-lifetime (e.g. "this row / this object is subject to litigation hold"), the console's Retention tab lets you pin the specific row, object, or table beyond its default policy. The hold survives DSAR erasure attempts and is audited.
- Honest DSAR erasure. When a user asks to be forgotten, held items are refused with a specific message the requester sees in their export: "retained under §257 HGB, purgeable after 2036-03-14". No silent no-op; no ambiguous "we removed everything we could". The exporter enumerates every held item + basis + earliest purge date so the user can plan a follow-up request.
- 10-year audit-log retention (vs 90 days on standard tiers) so the audit trail itself survives the same statutory window as the data it describes.
Where to find it in the console
Project → Compliance → Retention. The tab shows every currently-held row/object with its basis + expiry, an audit-log filter for retention actions, and a link to the upgrade CTA if you're not on Legal Team yet. DSAR erasure requests fired from the DSAR tab automatically respect any active holds.