Storage and Retention

Storage in EDI 2.0

Messages are temporarily stored in EDI 2.0 to ensure an exchange that is robust and asynchronous. The business document, which contains sensitive information, is stored in two contexts:

• As a MIME message, exactly as it was sent or received over EDI. The message is encrypted with the business certificate used for exchange over EDI. In cases where a message is sent from EDI 2.0 to multiple EDI recipients, a separate MIME message is stored for each recipient.
• As an independent business document that can be retrieved via API calls. This version of the message is encrypted with its own internal certificate.

Deletion and Retention

The business document is deleted as soon as transport is confirmed, i.e., when all recipients have acknowledged the message. For recipients over EDI, this occurs when we have received a transport acknowledgement (Acknowledgement or MessageError) for the message. For recipients over EDI 2.0 it means the message has been marked as downloaded using the appropriate API endpoint. If an acknowledgement is delayed, we will still delete the business document(s) after the retention period has elapsed. The retention period for business documents is 14 days.

Metadata associated with the message, including status, remain available until a separate retention period for metadata expires. The retention period for metadata is 1 year.

At-Rest Encryption and Decryption

At-rest encryption of the business document is performed at the application level.

The business document is encrypted with symmetric AES‑256 (256‑byte key) in CBC mode. The recipient (CmsRecipient) is authenticated with SHA256RSA.