Knowing when evidence
must live. Knowing when
it can safely die.

The question "how long must we keep this evidence?" has a different answer in every jurisdiction, for every case type, at every charge severity. A homicide case file in Virginia must be retained permanently. Misdemeanor traffic stop footage in Colorado may be retained for one year after case closure. Juvenile records in California carry distinct retention requirements that differ from adult records in the same jurisdiction. Federal evidence is governed by NARA-approved disposition schedules under 44 U.S.C. § 3303a, where destruction without approved authority is unlawful. Most agencies do not know their own retention requirements with precision — and the consequence of that uncertainty is universal over-retention. Vault's Retention Rule Engine eliminates the uncertainty. The system maintains a continuously updated library of retention schedules for all 50 states, the federal judiciary, municipal jurisdictions, and specialized courts (immigration, tribal, military). When evidence is ingested, the engine automatically determines the applicable retention period based on the evidence's case type, the severity of the most serious charge, the jurisdiction of filing, the evidence category (body-cam, forensic, documentary, physical item record), and the disposition status of the case. A body-cam recording linked to a felony assault charge in the Southern District of New York receives a different retention profile than identical footage linked to a misdemeanor trespass in Harris County, Texas — and the engine applies both correctly, automatically, at the moment of ingestion, without requiring any human to look up a retention schedule. When charges are elevated or reduced during the course of a case, the retention profile updates automatically to reflect the new charge severity. When cases are transferred between jurisdictions, the engine applies the more restrictive of the two jurisdictions' retention periods by default.

A retention timer means nothing if a legal hold applies. When a defendant appeals a conviction, every piece of evidence from the original trial must be preserved regardless of where it stands in its retention lifecycle — even if the retention period expired two years ago and the evidence was scheduled for destruction next Tuesday. When a civil rights lawsuit is filed against an officer, every piece of body-cam footage involving that officer must be preserved, even if the footage predates the incident at issue. When a FOIA request is submitted for evidence from a specific case, disposition must be suspended until the request is resolved. The failure to implement a legal hold — or the failure to implement it quickly enough — can result in spoliation sanctions that include adverse inference instructions, monetary sanctions, and in extreme cases, default judgment. Courts have held that the duty to preserve arises when litigation is "reasonably anticipated," which can be weeks or months before a lawsuit is actually filed. Vault's Legal Hold engine operates as a system-wide override. When a hold is issued — whether triggered by an appeal filing, a civil rights complaint, a FOIA request, a post-conviction review petition, or a manual hold from the prosecutor's office — the engine immediately identifies every evidence item within the hold's scope, suspends all retention timers for those items, prevents any disposition action regardless of the items' lifecycle status, and logs the hold with the issuing authority, scope, effective date, and legal basis. The hold is enforced at the infrastructure level — it is not a flag that a human must remember to check before approving a destruction batch. The system physically prevents destruction of held items, the same way a WORM storage system physically prevents deletion. When a hold is released (case resolved, appeal denied, FOIA request fulfilled), the engine automatically reclassifies the released items, recalculates their retention timers from the current date, and returns them to normal lifecycle processing. Every hold issuance, modification, and release is permanently documented in the WORM audit trail.

Not all evidence requires the same storage performance. Body-cam footage from an active homicide investigation — accessed daily by detectives, prosecutors, and forensic analysts — needs high-performance storage with low-latency retrieval. Body-cam footage from a resolved misdemeanor case four years ago — accessed perhaps once in the past two years for a FOIA request — does not need the same performance and should not incur the same cost. Yet in most agencies, both files sit on the same storage tier at the same cost per gigabyte because no automated system exists to differentiate between them. Vault's Tiered Storage engine manages evidence across four storage classes: hot (high-performance SSD for active investigations — fastest retrieval, highest cost), warm (standard storage for cases in prosecution or pre-trial phase — balanced cost and performance), cold (low-cost storage for closed cases within their retention period but rarely accessed — slower retrieval, significantly lower cost), and archive (lowest-cost storage for evidence approaching retention expiry or under long-term preservation requirements — retrieval in minutes rather than seconds, fraction of hot-tier cost). Migration between tiers is automatic and driven by two factors: case status and access frequency. When a case is closed, its evidence migrates from hot to warm. When no one has accessed the evidence for 180 days, it migrates from warm to cold. When the evidence enters the final 20% of its retention period with no access in the past year, it migrates to archive. Every migration is logged in the audit trail, and every migration preserves the evidence's integrity hash — the SHA-256 seal computed at ingestion remains valid regardless of which tier the evidence occupies. Evidence can be promoted back to a higher tier instantly if a case is reopened, an appeal is filed, or an investigator needs access — the system simply retrieves the file from the lower tier, verifies its hash, and serves it at full performance.

The most dangerous moment in the evidence lifecycle is the moment disposition is approved. If a single checkpoint is missed — if a legal hold was filed but not yet entered into the system, if an appeal was submitted yesterday but not yet processed, if a FOIA request is pending in a different department — the evidence may be destroyed prematurely, and no amount of documentation can bring it back. Vault's Disposition Eligibility engine treats every potential disposition as a multi-checkpoint verification event. Before any evidence item is classified as eligible for destruction, the engine verifies seven independent conditions: first, that the retention period has fully expired under the applicable jurisdiction-specific schedule; second, that no active legal hold applies to the item, the case, or any related case; third, that no appeal or post-conviction review is pending for the associated case; fourth, that no FOIA or public records request references the item or the case; fifth, that no open civil litigation (Section 1983 claims, excessive force lawsuits, wrongful conviction proceedings) implicates the evidence; sixth, that the item has not been flagged as potentially exculpatory (Brady material) by the compliance engine; and seventh, that the case has been formally closed with final disposition entered in the case management system. All seven checkpoints must clear before the item enters the disposition queue. If any single checkpoint fails, the item is blocked from disposition and its status is documented. The engine rechecks blocked items daily, automatically reclassifying them as eligible if the blocking condition resolves — an appeal denied, a FOIA request fulfilled, a civil suit dismissed. This approach ensures that disposition eligibility is not a one-time determination but a continuously monitored status that responds to every change in the legal landscape surrounding the evidence.

Evidence destruction is irreversible. Once a file is permanently deleted, no audit trail, no documentation, and no apology can bring it back. If the destruction was premature — if a legal hold should have been in place, if an appeal was filed the next day, if a FOIA request arrives a week later — the agency faces consequences ranging from sanctions to case dismissal. This irreversibility demands that the destruction workflow itself be as rigorous and defensible as the chain of custody that protected the evidence throughout its life. Vault's Destruction Workflow operates in four phases. First, the disposition batch is assembled: eligible items that have cleared all seven eligibility checkpoints are grouped by case type, jurisdiction, and retention category into a destruction batch with a unique batch identifier. Second, the batch is reviewed: a supervisor with destruction authority reviews the batch manifest, which documents every item, its case association, its retention schedule, the date its retention expired, and the results of every eligibility checkpoint. The supervisor must digitally sign the approval — their authenticated identity, timestamp, and the specific batch identifier are recorded immutably. Third, the destruction is executed: the storage system permanently deletes the files using cryptographic erasure (overwriting the encryption keys rather than the data, rendering the encrypted data permanently unrecoverable). The system generates a cryptographic proof of deletion — a signed attestation that the files corresponding to specific SHA-256 hashes have been rendered permanently inaccessible. Fourth, the destruction certificate is sealed: a comprehensive report documenting every item destroyed, the legal basis for each destruction, the supervisor approval, the cryptographic proof of deletion, and the WORM-sealed audit trail of the entire process. This certificate is retained permanently — even though the evidence is gone, the record of its lawful destruction never expires.

Retention conflicts are not edge cases — they are routine. A single piece of evidence may be subject to multiple, contradictory retention requirements simultaneously. Body-cam footage from an arrest may be linked to a felony case (state retention: 10 years after case closure), a use-of-force complaint (internal affairs retention: 5 years after investigation closure), and a pending Section 1983 civil rights lawsuit (litigation hold: indefinite until case resolution). The felony case closes. The internal affairs investigation concludes. But the Section 1983 suit is still pending. Which retention period applies? The answer is: the most restrictive one — in this case, the litigation hold, which prevents any disposition regardless of the other schedules. Vault's Conflict Resolution engine manages these overlapping obligations automatically. When an evidence item is subject to multiple retention profiles — because it is linked to multiple cases, subject to both criminal and civil proceedings, or relevant to both law enforcement and regulatory investigations — the engine calculates the effective retention period as the longest of all applicable schedules, modified by any active holds. If a conflict exists between two jurisdictional standards (federal versus state, for example), the engine applies the more restrictive standard by default and flags the conflict for human review. The resolution logic is fully transparent: every conflict detected, every resolution applied, and every override approved by a human reviewer is documented in the audit trail. When one of the competing requirements expires or is resolved — the Section 1983 suit is dismissed, for example — the engine automatically recalculates the effective retention period based on the remaining obligations. No human needs to remember that the lawsuit was resolved and that the evidence's retention profile should be updated. The system does it, documents it, and moves on.

Compliance audits are not optional events. NARA requires federal agencies to maintain approved disposition authorities for all records and to destroy records in accordance with approved schedules — retention periods are mandatory, and agencies must dispose of records after the period expires, except when a legal hold applies. State records retention boards conduct periodic audits of law enforcement agencies to verify compliance with state-specific retention statutes. CALEA (Commission on Accreditation for Law Enforcement Agencies) accreditation reviews examine evidence management practices, including retention and disposition compliance. Failing any of these audits has consequences: loss of federal funding, loss of accreditation, and in extreme cases, legal liability for unauthorized retention or unauthorized disposal. Vault's Compliance Audit engine generates comprehensive reports that answer every question an auditor will ask. For any audit period, the engine produces: a complete inventory of all evidence items in the repository with their current retention status; a disposition history documenting every item destroyed, the legal authority for destruction, the supervisor approval, and the cryptographic proof of deletion; a legal hold history documenting every hold issued, modified, and released, with the authority and reasoning for each action; a retention conflict report documenting every conflict detected and how it was resolved; and a compliance attestation certifying that no evidence was destroyed prematurely, no legal hold was violated, and no retention schedule was applied incorrectly. For NARA-aligned federal agencies, the engine generates reports in the format specified by the General Records Schedule, cross-referencing every disposition against the applicable GRS item number. For state agencies, the engine maps dispositions to the applicable state retention statute. The reports are WORM-sealed upon generation — they cannot be modified retroactively, even by the administrator who generated them.

Every agency's storage budget is wrong. It is wrong because it is based on last year's growth rate extrapolated forward, without accounting for changes in camera deployment, new evidence sources coming online, shifts in case volume, or the effect of disposition on net storage growth. An agency that deployed 400 additional body cameras last quarter will see a storage growth spike that last year's budget did not anticipate. An agency that implemented automated disposition for the first time will see a net storage decrease that the budget conservatively ignored. Vault's Predictive Storage engine replaces extrapolation with modeling. The engine analyzes historical ingestion rates by source type, seasonal variation in evidence volume (summer months typically generate more body-cam footage than winter), planned changes in camera deployment and evidence source expansion, the disposition pipeline's projected throughput (how much data will leave the repository as retention periods expire), and the tiering engine's projected migration schedule (how much data will move from high-cost to low-cost storage tiers). From these inputs, the engine produces an 18-month storage trajectory showing projected total repository size, net growth rate (ingestion minus disposition), storage cost by tier, and the infrastructure investment required to maintain the trajectory. For budget planning, the engine models "what if" scenarios: What happens to storage costs if the department adds 200 cameras? What happens if a large batch of misdemeanor evidence reaches disposition eligibility in Q3? What happens if a class-action civil rights lawsuit triggers legal holds across 5% of the repository? These projections allow agencies to present data-driven storage budgets to city councils and county commissions — replacing "we need more storage" with "we need 2.4 additional petabytes of archive-tier storage by Q3 2027, offset by 1.8 petabytes of eligible disposition, resulting in a net investment of $340K rather than the $1.2M that flat-rate growth would require."