Soft-delete is 30 days visible, then 30 days backend-only vault. Empty moves to vault (does not bypass retention). Recovery restore needs MFA + dual approval. Legal holds override TTL. Final purge shreds wrapped DEKs; vault is never client-readable.