"I deleted that message months ago" and "the message no longer exists" are different statements, and the gap between them is retention. This chapter explains what the platform keeps, where it keeps it, and which switches change the answer — in plain terms, because retention misunderstandings cause both compliance failures and privacy complaints.
Where Content Actually Lives
Collaboration content is not stored in one vault. Channel conversations and their files sit with the team's underlying group storage; private chats sit in each participant's mailbox store; one-to-one call metadata joins the same trail. This distribution is why retention settings must be applied per workload — a policy covering channel content does not automatically cover private chats, and vice versa.
Policies, Labels, and Holds: Three Different Levers
- Retention policies apply to everyone or to chosen locations: keep for N years, then delete, or keep forever. They are invisible to users.
- Retention labels are applied by users (or automatically by content matching) to individual items: this contract keeps seven years from signing.
- Legal holds suspend deletion entirely for named people or locations until released, overriding every policy and label.
The precedence rule to memorise: hold beats keep-forever beats longest keep beats delete. When two rules conflict, the more conservative one wins — which is why "we thought it was deleted" surprises organisations during litigation.
Deleted is a process, not an event
When a user deletes a message under an active retention policy, the message disappears from their view but persists in the compliance store until the period ends. Conversely, when retention expires, deletion happens in stages across stores and can take weeks to complete everywhere. Both directions are gradual; plan communications and audit answers accordingly.
Choosing Periods Without a Law Degree
Start from three inputs: regulatory minimums for your industry, contractual obligations, and genuine business need. Then resist the urge to add "a bit more for safety" — over-retention multiplies discovery costs and privacy exposure with every passing year. A defensible schedule with documented reasoning beats a hoard every time.
What Users Should Be Told
Transparency is both ethical and practical: publish a one-page note stating that workplace conversations are retained for defined periods, that deletion by the user does not erase the compliance copy, and that holds may preserve content during investigations. Employees who understand this write more carefully, which is a security control money cannot buy.
Testing Your Configuration
- Create a test channel and a test chat; post dated marker messages.
- Apply the intended policies; verify the markers appear in a compliance search as expected.
- Delete a marker as a user; confirm it vanishes from view but remains searchable by the compliance role.
- Repeat annually and after every platform change that touches retention.
Retention answers "what survives". The next chapter answers the question employees ask most often and administrators answer least clearly: what can your admin actually see?
