This post is maintained by Bytebase, an open-source database governance platform that is SOC 2 Type II compliant. Bytebase helps teams implement SOC 2 controls at the database layer, including access control, audit logging, change management, and data retention.
What is SOC 2?
SOC 2 (System and Organization Controls 2) is a widely adopted security and compliance framework developed by the American Institute of Certified Public Accountants (AICPA). It sets the standard for how service organizations should manage customer data to protect it from unauthorized access, security incidents, and operational failures — especially in cloud-based environments.
SOC 2 compliance is evaluated against five Trust Services Criteria:
- Security (mandatory) — Safeguarding systems and data from unauthorized access
- Availability — Ensuring systems operate reliably and as promised
- Processing Integrity — Verifying accurate and complete data processing
- Confidentiality — Protecting sensitive information from disclosure
- Privacy — Handling personal data appropriately
There are two report types:
- Type I: A snapshot of controls at a single point in time
- Type II: An audit of how well those controls operate over time (typically 3–12 months)
Type II reports are considered more rigorous and credible, especially for enterprise customers.
Why SOC 2 Matters for Database Systems
SOC 2 is particularly relevant for:
- SaaS platforms and cloud service providers
- Organizations that manage large volumes of user data
- Teams responsible for storing, processing, or transmitting customer data in production environments
While SOC 2 encompasses multiple operational areas, this article focuses specifically on the database-related aspects of SOC 2 — namely, data retention requirements, with pointers to where data security is covered.
These are the areas where tools like Bytebase can help engineering teams automate and enforce controls for compliance.
Data Security Requirements
In SOC 2, Security is the only mandatory Trust Services Criteria, and for a database it comes down to three groups of criteria: logical access (CC6), monitoring and security events (CC7), and change management (CC8). Those are mapped criterion by criterion, with the evidence auditors sample, in Database Access Control for SOC 2. The audit log requirements are covered in SOC 2 Audit Log Requirements.
The rest of this post covers the part those two do not: data retention.
Data Retention Requirements
Under SOC 2’s Confidentiality and Privacy criteria, organizations must manage data responsibly throughout its lifecycle. While SOC 2 doesn’t specify exact durations, it requires:
- Identifying and classifying sensitive data in databases
- Defining retention periods by data type
- Protecting data during retention
- Ensuring secure and verifiable deletion afterward
Bytebase users can align retention policies with data classification, data masking, schema change management, and audit logs to ensure enforcement across environments.
Here is the basic process to implement data retention policies:
1. Data Identification & Classification
- Audit what data is stored across all environments (e.g., production, staging)
- Classify by sensitivity: e.g., Public, PII, PHI, Confidential
- Map data types to retention and deletion policies
Consider tagging schemas or tables in Bytebase by classification.
2. Legal and Compliance Requirements
- Identify applicable regulations: GDPR, HIPAA, SOX, PCI DSS, etc.
- Document how retention timelines map to legal obligations
- Include any client contract clauses affecting data storage
3. Retention Periods
- Define periods per data category or table
- Consider different rules for logs, transactions, and user profiles
- Document in a central retention policy referenced by DBAs and auditors
4. Secure Deletion Procedures
- Detect data that has reached its retention limit
- Apply deletion techniques appropriate to your database engine (e.g., row-level delete, partition drop, full table purge)
- Log and verify all deletions
- Automate purging when feasible
Integrate deletion workflows with Bytebase’s change workflows and audit logs for traceability.
Best Practices for Database Retention
- Policy Review: Update regularly to stay aligned with evolving laws and systems
- Automation: Use tooling to reduce manual effort and risk
- Backups: Include backup lifecycle management in your retention strategy
- Auditing: Log all deletion activities; regularly validate adherence
- Legal Holds: Implement workflows to override retention rules during investigations
By formalizing your database data retention policy and combining it with secure, automated workflows, you strengthen both your SOC 2 compliance and your organization’s operational maturity. Tools like Bytebase not only enforce these controls, but also simplify evidence collection for audits.