Compliance

Civagent lets municipalities configure how long different record types are kept—such as conversation records, uploaded files/knowledge base documents, and audit logs—with retention periods that can vary by department or project. Retention is enforced on a schedule, with audit logs archived before deletion and each deletion recorded, while legal holds can pause retention when preservation is required.

Civagent keeps a tamper-evident, append-only audit trail so agency staff can see what actions occurred, when, and by whom. It records activity such as user/admin actions, AI conversation activity, knowledge base access, retention setting changes, legal hold events, and retention deletions, with configurable retention and export options to support audits, investigations, and public records responses.

Civagent aligns with key NIST 800-53 controls, focusing on AU-11 (Audit Record Retention) and SI-12 (Information Management and Retention). It highlights Civagent's tamper-evident audit trail, configurable retention for different record types, archiving of audit logs before deletion, and legal holds, and lists the evidence municipalities can request to demonstrate compliance.

Civagent supports controls commonly examined in SOC 2 vendor assessments, particularly those concerning data retention and disposal. This note concentrates on C1.2 (Confidential Information Disposal) and P5.1 (Data Retention).

Civagent maintains a durable record of every deletion carried out under a retention policy. The result is an evidentiary trail: proof that records were disposed of in accordance with approved schedules, and that any legal holds in force were honoured.

Civagent supports legal holds to prevent records from being deleted when preservation is required for litigation, public records requests, regulatory oversight, or internal investigations. They can apply to conversations, uploaded files/knowledge base documents, audit logs, or broader scopes like specific projects or departments, and both creating and releasing a hold are logged before normal retention resumes.