Data classification and retention

Data classification and retention is a practical way to get a handle on the sensitive data your company holds. Classification means sorting your data by how sensitive it is, for example public, internal, confidential, and regulated, so you know what needs protecting. Retention means deciding how long to keep each type before deleting it, so you are not sitting on years of data you forgot you had. Together they give you a simple scheme, a map of where sensitive data lives and who can see it, a written retention schedule, and a light ongoing check that keeps all of it current.

A spreadsheet inventory is a snapshot that is out of date the week after you finish it, and it relies on people remembering every place data lives, which they do not. This scans your actual drives, inboxes, CRM, and contract folders to find where sensitive data really sits, tags it against a scheme you agree on, and proposes a retention window for each type. The bigger difference is the ongoing check: it flags data past its keep-by date and new stores that need classifying, so the picture stays live instead of rotting in a tab nobody opens again.

No, because deletion is never silent or automatic here. The system flags data that is past its retention date and surfaces it for a person to review, but it does not delete on its own. That safeguard exists precisely because auto-deletion is dangerous: if something is under a legal hold or a regulatory retention rule, deleting it turns a cleanup into a serious problem. Retention periods for regulated data are set with your counsel, not guessed, and anything under a hold is excluded from deletion. You keep the final call on what actually gets removed.

Honestly, not on the first pass, and it is built to be upfront about that. A scan finds sensitive data by patterns, so unusual formats, scanned images, or data in a tool it is not connected to can slip past at first. That is why the first pass focuses on the biggest and highest-risk stores, and why the ongoing check keeps widening coverage as new sources come in. A person reviews the edge cases rather than trusting the scan blindly. You get most of what matters quickly, then a process that keeps closing the gaps instead of a one-time report that pretends it caught everything.

On the scanning side, it reads file stores like Google Drive and Google Workspace, Microsoft 365 and SharePoint, Dropbox, and Box, your CRM such as Attio, email, and contract or e-signature tools like DocuSign. On the output side, the map and retention schedule can live in a shared doc, your CRM, or wherever your team will actually keep it current. Most tools with an API can be added. The audit maps your exact stack and picks the stores that matter most to scan first.

Usually two to three weeks. The first days go to connecting your file stores and running the initial scan to find where sensitive data lives. Then you agree the classification scheme, and the data gets tagged against it. The retention schedule is set next, with your counsel deciding the periods for any regulated data. The rest of the window is tightening access on the sensitive stores and setting up the light ongoing check so the map and schedule stay current after the first pass, rather than going stale.

Two parts. Tooling runs as a modest monthly cost for scanning and tagging, which scales with how many stores and how much data you cover. Implementation is a fixed scope, quoted once the audit maps your data stores, your classification scheme, and your retention rules, so you are pricing a defined build rather than an open-ended retainer. The audit itself is where the scope and price get set against every other opportunity in your business, priced as part of the audit, so you are not guessing at effort up front. Note that this is not legal advice; your counsel sets retention periods for regulated data.