User data has a bounded retention period enforced by a purge mechanism or a committed retention schedule

SOC 2 C1.2 requires that confidential information be disposed of when it is no longer needed, and "show me your retention schedule and the mechanism that enforces it" is a standard confidentiality-section request; this check evidences C1.2 directly (ISO 27001 A.8.10 and NIST SI-12 map the same obligation). AI-generated and vibe-coded apps fail this almost universally: coding assistants scaffold tables that only ever grow (users, sessions, events, messages, request logs) because every training example inserts and none deletes, so the default posture is indefinite retention of everything, which inflates breach blast radius, storage cost, and GDPR storage-limitation exposure with every day the app runs. One passing leg of this check is an evidence-pointer: where retention is enforced by a managed platform or an operations habit rather than repo-visible code, a committed retention schedule document naming data classes and periods is the evidence, which is exactly the artifact a SOC 2 auditor will ask for. This check is deliberately distinct from account-deletion-coded in this same audit: that one is user-initiated erasure on request (GDPR Art. 17); this one is systematic retention bounds for data nobody asked to delete.

Pick the cheapest leg that fits your stack. Code leg: add a scheduled purge, for example a vercel.json crons entry pointing at app/api/cron/purge-expired/route.ts that runs DELETE FROM sessions WHERE created_at < now() - interval '90 days' (or the Prisma/Drizzle equivalent), or a cron.schedule(...) call in a pg_cron migration under supabase/migrations/. Storage leg: a Mongo TTL index (expireAfterSeconds), a DynamoDB TTL attribute in your IaC, or Redis EXPIRE on user-data keys. Evidence leg: commit docs/ops/data-retention.md listing each stored data class (accounts, sessions, analytics events, logs, backups) with its retention period and how disposal happens, including "retained indefinitely" entries where that is a deliberate choice. Platform-enforced retention documented in that file is acceptable auditor evidence; undocumented defaults are not.