Retention policy
Also called retention rule, retention period, data retention policy
A rule an admin sets that says how long one kind of record is kept and what happens to it when the time is up.
A retention policy answers 2 questions about a kind of record: how long is it kept, and what happens when that time is up. The answer at the end can be deletion, or keeping the record for good.
Prompts and answers on a business AI plan are records like any other, and each AI tool has a setting for them. If nobody at the company has chosen, the supplier's default applies, and defaults range from a fixed number of months to keeping everything.
How long to keep them is a question of legal risk and of the record-keeping rules the business works under, so the number is chosen by whoever owns records, with legal. Security's part is to know where the setting is and what it says.
For example
A company sets its AI assistant's chats to be deleted 12 months after the last message. Nobody had chosen before, and the supplier's default had been keeping them indefinitely.
Put it to use
Where you'll meet retention policy in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.