> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/trust-security-and-data-handling/retention-and-deletion.md).

# Data Retention & Deletion

This page describes how long AOH Sync retains different categories of data and what happens to identity data when a connector is removed or a user is deprovisioned.

***

## Retention by data category

### Synchronization logs

Domain directory sync logs are stored with a **90-day expiry stamp**. Each log record is written with an `expires_at` timestamp set to 90 days after the record is created. Records past their `expires_at` date are eligible for cleanup.

### Identity lifecycle events

Lifecycle events (joiner, mover, leaver) are stored in both the identity graph and the relational event store. No automatic expiry is configured for lifecycle events in the sources reviewed.

### Identity graph data (Users, Groups, Departments, Sources)

Identity graph nodes and edges represent the current state of your connected sources. When a sync run removes a User from all sources (for example, because the person no longer exists in any connected system), AOH Sync updates the graph accordingly. The mechanics of hard deletion vs. soft deactivation for graph nodes are:

### Configuration data

Provisioning configurations, attribute mappings, scheduled jobs, and connector definitions are retained as long as they exist in the AOH Sync configuration. Deleting a connector or an Entra provisioning target removes its configuration record.

### Vault secrets

Secrets stored in the Vault are retained until explicitly deleted or rotated. When a connector or Entra target is deleted, the associated secret in the Vault should be removed as part of the offboarding process.

***

## Deprovisioning: what happens when a user leaves

When AOH Sync detects that an identity has been removed from or disabled in all connected Source Systems, it records a **leaver** lifecycle event and updates the identity's status. The provisioning engine then applies the configured leaver action to the target Entra ID tenant (for example, disabling the account or removing group memberships).

***

## Removing a connector

When you delete a Source System connector from AOH Sync:

1. The connector's configuration record is removed from the configuration database.
2. Subsequent sync runs no longer pull data from that source.
3. Identity data that was sourced exclusively from that connector remains in the identity graph until a sync reconciliation determines it is no longer present in any remaining source.

***

## Data deletion upon license termination

Because AOH Sync runs entirely within your Azure subscription, you retain control of the VM and its storage at all times. You can delete all AOH Sync data by deleting the VM and its attached disks from your Azure subscription.

***

## Related

* [What Data AOH Sync Stores](/trust-security-and-data-handling/what-data-we-store.md)
* [Where Your Data Lives](/trust-security-and-data-handling/data-residency.md)
* [Encryption](/trust-security-and-data-handling/encryption.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/trust-security-and-data-handling/retention-and-deletion.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.