The obligation runs to the officer, not the vendor
52 U.S.C. §20701 requires retention of election records for 22 months following a federal election. State schedules typically run longer and are frequently inconsistent with the federal floor. Privacy and public-records law may require deletion or redaction inside the same window.
Why this is an architecture question and not a policy question
Append-only systems retain by default, which sounds like it settles the matter and does not. The resolution Module 6 teaches is structural: separate the custody record — envelope-level, carrying no voter-identifying information after extraction — from the personal data, which is held separately under its own governance and can be redacted on the privacy schedule without invalidating any proof already issued.