A database with a real-time replica and independent backups, restorable deleted records (soft delete) and retention: audit 365 days, terminated staff 5 years.
Replica and backups
The product database has a replica that receives every change in real time (continuous replication), and the infrastructure provider keeps independent backups of it. The blog database is separate with its own backup, so a problem with site content never touches payroll.
Deleted by mistake
No record is destroyed when deleted: it is marked as deleted and disappears from screens and reports, but stays in the database and can be restored by support. This applies to employees, periods, benefits, time entries and everything else.
Retention periods
Some data has a deadline: the audit trail is kept for 365 days, sent-email and API call logs for 90 days, AI assistant conversations for 180 days and terminated employees' data for 5 years after the exit, when it is anonymized. A daily routine applies these periods. Approved payrolls, payslips and invoices do not expire while the company exists.