The article
A customer asks you to delete everything you hold about them. The team deletes the account, and the data is still in last night's backup, in the application logs, in an export someone emailed in March and in the test database a developer copied from production. Data management compliance is knowing those places exist before the request arrives, and having rules that reach them.
I have been in software development for 18 years, and since 2017 my team, now 70+ specialists, has delivered 150+ projects. We are engineers, not lawyers. Your counsel, data protection officer or compliance officer decides how long each kind of data may be kept and who may see it; we find the data, sort it and build those rules into your databases and apps, so they run when nobody is checking.
Data management compliance: the short version
| Question | Answer |
|---|---|
| What it is | Handling data the way laws and contracts require, and being able to prove it |
| Who sets the rules | Your counsel, data protection officer or compliance officer |
| What we build | A catalog of your data, classes, access rules, and retention and deletion that run on their own |
| Price | Estimated before work starts; the first call and the rough estimate are free |
Four steps: find, sort, decide, automate
- Find. A catalog of the data you hold and where it lives: every database, file store, log and outside tool. We start from the systems rather than a questionnaire, because people forget copies and systems do not.
- Sort. Four classes are usually enough: public, internal, confidential and regulated. Every table, field and folder gets one.
- Decide. For each class: who may see it, who may change it and how long it is kept. The periods come from your counsel, the law and your client contracts.
- Automate. Retention, archiving and deletion run as scheduled jobs, access is logged, and every deletion leaves a record of what went, under which rule and when, without keeping the data itself.
Where data hides: a self-check
In October 2026 I read the three company pages Google shows for this search; the rest are forums, a podcast, news and a magazine article. All three talk about access control; none mentions a data inventory, backups or where the data is processed, and retention comes up once, in a line about call recordings. A small sample, but the places they skip are in this table: go through it with your team, and every "not sure" becomes a line in the catalog.
| Place | Why it is forgotten | How to check |
|---|---|---|
| Application logs | Code writes them, and they fill up with emails, IP addresses and IDs | Search one day of logs for one customer's email |
| Backups | Kept for months, outside the retention policy | Compare the backup schedule with your longest retention period |
| Test and staging databases | Copied from production "just once" | Ask who has a copy of production data, and from when |
| Exports and spreadsheets | Downloaded for one report, then shared | Search the shared drive for files named "export" |
| Support tickets | Customers attach documents to them | Search the help desk for attachments |
| Analytics and marketing tags | They send more than anyone set up | Check what the tags send from your signup page |
| File storage | Uploads outlive the accounts they belong to | Count files whose owner account is gone |
| AI tools | People paste customer data into prompts | Ask which AI tools the team uses, and on whose account |
| Vendors | Your CRM, email platform and payment provider keep their own copies | List each vendor and what it receives |
| Screenshots and demos | Real screens show real people | Open your sales deck |
The last row is the easiest to miss. For the site of Clemond we rebuilt the app's screens by hand instead of using screenshots, because real screenshots contain real people.
Retention is a rule your code has to run
A retention period on paper deletes nothing. Take one rule as an example: the FTC's Safeguards Rule (16 CFR 314.4) asks a covered financial company for procedures to dispose of customer information no later than two years after it was last used to serve that customer, unless the information is needed for business operations, the law requires keeping it, or targeted disposal is not reasonably feasible. Whether it applies to you is your counsel's call; what it asks of the software holds for any retention rule:
- a date on every record that starts the clock: the last time it was used, not the day it was created;
- a hold flag that stops deletion when the law or a dispute needs the data kept;
- a job that deletes on schedule, and a log that proves it ran;
- a plan for backups: they expire on their own schedule, and a restore re-applies the deletions made since.
Requests from people to see or delete their own data are covered on data privacy and GDPR.
Where the data is processed matters too
Some rules care where data is processed, not only how long it is kept. In the AI Call Center we built in the UAE, every call is processed inside the country, on local servers with AI models hosted there: a voice agent on foreign cloud models was not an option for that data. In RxPhoto, where we worked on the backend, the web front end and the API behind the mobile app, an audit log lets administrators show who opened which patient record and when. In AWS, Azure or Google Cloud, regions and log retention are part of the same work: cloud compliance.
A data compliance company, a platform, or both
Enterprise data management companies sell platforms: catalogs, lineage, governance dashboards. They are good at showing what you have, but a platform does not change your code, and the rules live in your code: the deletion job, the access check, the log. As a data management software company, we connect the tools of data management vendors where they fit and build the parts they cannot reach. A data compliance company that only writes policies leaves the engineering half to you.
What the price depends on
- how many systems hold the data, and whether a catalog already exists;
- how many classes and retention rules your counsel sets;
- how much old data has to be cleaned up before the jobs take over;
- whether a vendor's platform fits, or the work is custom.
Everything is estimated before work starts; the first call and the rough estimate are free, and we sign an NDA before you show us where your data lives. The code we write for you is yours once it is paid for. We answer new requests within 30 minutes on weekdays, 9:00-18:00 Miami time, and the rest of our compliance work is on the compliance page.
