Event-Driven Notification Platform · View 11 of 26 · 3 · Data

Data Architecture and Retention

What is authoritative, what is rebuildable, and how long each thing lives.

Editable source SVG draw.io All views

The dividing line

Authoritative data — configuration, consent, templates, audit — cannot be reconstructed and defines the backup scope
Operational data can be rebuilt from the event archive, so it is sized for speed rather than for durability
This is why backup is small and cheap while the platform still stores about a billion delivery rows a day

Retention

Kafka 3 to 7 days by tier; DLQ 30 days
Notification records hot 30 days in PostgreSQL, then Iceberg for 13 months
Delivery attempts 90 days raw in ClickHouse, rolled up to 13 months
Raw events 400 days in Iceberg; audit 7 years under object lock; PII deletable on request within 30 days

Assumptions

400 days for raw events covers a full year plus a reconciliation window; confirm against the tenant contract
Object lock on the audit bucket satisfies the write-once requirement without a separate WORM appliance

◀ Event Topology and Priority Tiers All views Core Data Model ▶