Operations
Deletion and retention
Trash, revisions, purge deadlines and what "deleted" really means in Vaultigen.
Deleting in Vaultigen is a two-step process. First an item moves to the trash, where it is safe and recoverable. Only after a waiting period does a background job remove it for good.
Deleting entries and folders
- Only a vault Manager can delete. A confirmation prevents mis-clicks, and the deletion is audited.
- A deleted entry disappears from lists and search immediately; opening it directly reports “not found”. Its values stay encrypted in storage until the purge.
- A folder can only be deleted when it is empty. Vaultigen never deletes a folder together with its contents. Entries already in the trash do not block it.
Restoring
Managers open the vault’s Trash. It lists deleted entries and folders with the deletion date and the purge deadline. Restoring puts an entry back into its original folder, or at the vault root (“No folder”) if that folder was deleted too. Restoring requires the vault to be active.
Retention settings
Under Settings → Trash and history retention:
| Setting | Default | Meaning |
|---|---|---|
| Trash retention | 30 days | How long deleted items stay restorable (1–365 days). |
| Revision count limit | 50 | Revisions kept per entry. 0 keeps all. |
| Revision age limit | 365 days | Older revisions are removed. 0 disables the limit. |
The scheduled vaultigen:purge-trash command removes expired items: the entry, its revisions, grants, tag links and reveal tracking. Attachment files follow the same model. If a purge fails, nothing is partially deleted; the job retries later.
Purging a whole vault
A Custodian or Super Admin marks a vault pending purge. From that moment nobody can access it, not even through emergency access. A Super Admin still sees it in Vault administration, with its deletion date, and can restore it unchanged until then.
When the Vault purge waiting period ends (30 days by default, set under Settings), the scheduled purge permanently deletes the vault with everything in it. The audit log keeps a record of the deletion. If Email when a vault is marked for purge is on, the security notification recipients are alerted when a vault is marked.
What deletion does not do
- An older backup may still contain a purged item until that backup ages out. For a credential that truly must be gone, change it at the external service.
- Deleting an entry does not change the password at the service it belongs to.
See also Audit log retention and Offboarding.
Found a mistake? Tell us at [email protected].