Data retention policy limits CDE storage to business requirements

PCI-DSS 4.0 Req 3.2 limits cardholder data storage to the minimum required for business or legal needs; Req 3.2.1 requires that data retention and disposal policies are defined and implemented. Data that is never deleted accumulates indefinitely — old failed transaction records, expired tokens, and support tickets create a growing pool of sensitive data that broadens breach impact year over year. GDPR Art. 5(1)(e) (storage limitation) and NIST SI-12 both require data to be disposed of when no longer needed. Without automated purging, retention policies are aspirational rather than enforced.

Create docs/data-retention-policy.md with specific retention periods for at least three data types, then implement automated purging via a Vercel cron route or database scheduled job. Without automation, the policy is not enforced.

// src/app/api/cron/purge-data/route.ts
export async function POST(req: Request) {
  if (req.headers.get('authorization') !== `Bearer ${process.env.CRON_SECRET}`)
    return new Response('Unauthorized', { status: 401 });

  const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_KEY!);
  // Purge failed transactions older than 90 days (PCI Req 3.2)
  await supabase.from('failed_transactions').delete()
    .lt('created_at', new Date(Date.now() - 90 * 864e5).toISOString());
  return new Response('ok');
}

In vercel.json, schedule the route at "cron": "0 3 * * *". Define transaction logs (7 years), audit logs (3 years), and failed attempts (90 days) as the minimum three retention categories.