What’s the official stance on TTL for data retention?

What kind of data do we retain, and for how long? Are there conflicts with compliance standards?

We don’t retain data, but we retain some metadata from blocked or flagged requests. This metadata is restricted to security-relevant attributes designed for detection and analysis. For such forms of metadata, the TTL is 90 days