Sample rows removed. Evidence projections via CASA_API.auditportal. Cannot mutate source records, permissions, publication, refunds, or audit history.

Soft-delete is 30 days visible, then 30 days backend-only vault. Empty moves to vault (does not bypass retention). Recovery restore needs MFA + dual approval. Legal holds override TTL. Final purge shreds wrapped DEKs; vault is never client-readable.

Evidence is read-only and field-allowlisted. Observations do not mutate source. Exports need purpose, legal basis and dual approval for sensitive sets; CSV is formula-escaped, encrypted with a one-time DEK, and download TTL is not extended on retry. Privacy deletion queues soft-delete for Prompt 24.