Skip to main content

Retention policies

7-year evidence pack retention, soft delete, 30-day recovery window.

Overview​

This article is part of the Compliance section of the Falcon Veritas Intelligence support center. It is written for engineers, analysts, and tenant admins working with the FVI platform on a daily basis.

Each concept below maps to a specific table or stored procedure in the FVI codebase (Supabase migration set 285 migrations as of 2026-08-22). The full Compliance reference lives at docs.falconveritas.com/compliance.

If you are new to Compliance, start with the Compliance overview and the core concepts guide. Cross-references to the Troubleshooting, Runbooks, and Security surfaces are inlined throughout.

Prerequisites​

  • Tenant ID and authentication. You need a valid tenantId and either a publishable key, a JWT issued by Supabase Auth (HS256 or RS256), or a service-role key with a justified call-site.

  • Roles. tenant_admin or the role documented as required in the relevant API reference page.

  • Browser (for UI flows). Modern evergreen browsers only — last two versions of Chrome, Firefox, Safari, Edge.

  • API access (for code paths). Install the SDK of your choice from /api/sdks.html — TypeScript, Python, Go, .NET. Bearer keys are issued via POST /v1/tenants/{id}/api-keys.

  • Auditor context. If your call is server-side and crosses tenants, ensure audit logging is wired via the security_events table (see audit trail).

How it works​

The flow below shows the canonical path through Compliance at the FVI platform. Every arrow corresponds to an API call (or to a stored procedure in the supabase/migrations/ tree).

Source: supabase/migrations/20260822000001_match_engine_v2.sql and src/lib/reconciliation/compliance.ts. The full audit paper trail is in the incident response runbook.

Step-by-step​

Confirm tenant and scope.

Read your tenant ID from the dashboard URL bar (or call GET /v1/me). Verify the JWT contains https://falconveritas.com/tenants with your tenant in the claim list. Source: src/routes/auth.tsx.

Verify preconditions.

If this flow requires prior data (matches, rules, exceptions), confirm via the compliance API that the precondition rows exist. Use idempotency keys for any POST.

Submit the request.

Use the SDK of your choice. For raw HTTP, set Authorization: Bearer <jwt> and X-Tenant-Id: <id>. For service-to-service, use the publishable key and let RLS do the tenant scoping (see RLS policies).

Confirm the response.

On success, FVI returns a 2xx with an idempotent identifier. On 4xx, the error code is one of the documented error codes. On 5xx, file an incident per the incident response runbook.

Code samples​

curl​

curl -X POST https://api.falconveritas.com/v1/compliance \
 -H "Authorization: Bearer $FVI_JWT" \
 -H "Content-Type: application/json" \
 -d '{
 "tenantId": "$FVI_TENANT_ID",
 "operation": "list",
 "limit": 50,
 "idempotencyKey": "fvi-demo-$RANDOM"
 }'

TypeScript​

import { FVI } from '@falconveritas/sdk';

const fvi = new FVI({
 baseUrl: 'https://api.falconveritas.com',
 bearer: process.env.FVI_JWT!,
 tenantId: process.env.FVI_TENANT_ID!,
});

const result = await fvi.compliance.list({ limit: 50 });
console.log(result.items.length, 'items');

Python​

from falconveritas import FVI

client = FVI(
 bearer=os.environ["FVI_JWT"],
 tenant_id=os.environ["FVI_TENANT_ID"],
)
items = client.compliance.list(limit=50)
print(len(items), "items")

Troubleshooting​

API reference​

The endpoints most relevant to this page:

MethodEndpointPurposeGET``/v1/complianceList records for this surfacePOST``/v1/complianceCreate a new record (idempotency-key required)GET``/v1/compliance/{id}Fetch a single recordPATCH``/v1/compliance/{id}Partial updateDELETE``/v1/compliance/{id}Soft delete (soft_delete = true; purge after 30 days)

Full OpenAPI 3.1 spec: docs.falconveritas.com/api-reference.

Last updated: 2026-08-22 · Page owner: Documentation · Reviewed: Bianca (brand), Aria (a11y), Source: src/lib/compliance/.