Modes
FULL stores allowed content; REDACTED removes known PII; METADATA_ONLY keeps operational metadata; CUSTOM applies an application policy. Secrets are always excluded.
Deletion
Trace, user and project deletion plus export/retention run as idempotent worker jobs. PostgreSQL audit events prove completion; R2 objects follow the same retention lineage.