# Engineering handbook — data & platform

## Data retention policy
Customer data is retained for the duration of the account plus 90 days
after deletion, to allow for accidental-deletion recovery. Application logs
are retained for 30 days; security audit logs are retained for 1 year to
satisfy compliance requirements. Backups are encrypted at rest and rotated
every 24 hours with a 14-day retention window.

## Database migrations
Schema migrations must be backward-compatible with the previous application
version to support zero-downtime deploys: add columns as nullable first,
backfill, then enforce constraints in a follow-up migration. Migrations
affecting tables over 10 million rows require a review from the database
team and must run online without locking writes.

## API versioning
Public APIs are versioned in the URL path (/v1/, /v2/) and each version is
supported for at least 12 months after the next version ships. Breaking
changes require a new major version; additive changes (new optional fields)
can ship within the current version. Deprecation notices go out at least 90
days before a version is sunset.

## Feature flags
New user-facing features must ship behind a feature flag unless the change
is a pure bugfix. Flags default to off in production and are rolled out
gradually: 1% -> 10% -> 50% -> 100%, with at least a 24-hour soak at each
stage for risky changes. Stale flags older than 90 days are flagged for
cleanup in the quarterly flag audit.

## Internal dashboards
Engineering metrics dashboards refresh every 15 minutes and pull from the
same warehouse tables used for the quarterly business review. Dashboard
access is open to all engineers; editing dashboard definitions requires the
data-platform team's review.

## Data warehouse costs
Ad-hoc warehouse queries over 1TB scanned trigger an automatic Slack alert
to the requester and the data-platform on-call, since large ad-hoc queries
are the leading cause of unexpected warehouse cost spikes.

## Team communication norms
Teams default to public channels over DMs for anything work-related, so
context stays searchable. Cross-team requests go through a dedicated
request channel rather than pinging individuals directly, and response-time
expectations there are best-effort, not an SLA.

## Tooling procurement
New SaaS tool requests over $500/year go through a lightweight procurement
review covering security and data-handling questions before purchase.
Renewals under the same terms skip the review and are approved by finance
automatically.

## Internal wiki hygiene
Wiki pages without an update in 12 months are flagged stale and surfaced in
a quarterly cleanup pass; owners either refresh or archive them. Search
ranking on the wiki favors recently-edited pages over older ones.