ASD ISM 2123Delete AI Chat Session Prompts and Outputs
When a chat session is removed from an AI application, every prompt and output associated with that session is securely and unrecoverably deleted from all locations it was stored in.
Plain language
When someone deletes a chat session in an AI application, the questions they typed and the answers the model gave must not just disappear from the screen. They must be permanently and unrecoverably wiped everywhere a copy was kept. That includes caches, backups, log files, any store used to fine-tune or train the model, and any vector index or database that holds the conversation for retrieval. The aim is that no copy of the prompts or outputs can be recovered once the session is removed.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
05 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentTopic
Data collection, retention and use
Official control statement
All prompts and outputs associated with chat sessions are securely deleted when chat sessions are removed from AI applications.
Why it matters
If session prompts and outputs are only removed from the visible session list but linger in caches, backups, log files, fine-tuning or training datasets, or RAG vector indexes, that data stays recoverable after a user believes it is gone. Sensitive content typed into prompts (credentials, personal information, intellectual property) can later be retrieved from those secondary stores, resurface in model outputs to other users, or be exposed in a breach of a backup or log archive, defeating the user's deletion request and the organisation's retention controls.
Operational notes
Maintain an inventory of every place chat prompts and outputs come to rest (the primary session datastore, application and inference caches, log pipelines, backup snapshots, any fine-tuning or training corpus, and RAG vector indexes or embedding databases) and tie a deletion action in each to the session-removal event. Where a store cannot be edited in place (such as immutable backups or already-trained model weights), define a compensating control such as crypto-shredding the per-session encryption key, or a backup expiry window after which the data is purged, and record this as accepted residual exposure. Re-test deletion after every change to the AI application's storage architecture, third-party model provider, or backup tooling, because new caches or replicas are easily introduced. Confirm with the model or platform provider in writing how they handle deletion of prompts and outputs they hold on your behalf, including any retention for abuse-monitoring.
Implementation tips
- Map every store that holds chat prompts and outputs (primary session database, application and inference caches, log sinks, backup snapshots, any fine-tuning/training corpus, and the RAG vector index or embedding database) then wire the session-removal action to trigger a delete in each one.
- Configure the session datastore and caches to perform a secure delete (overwrite or cryptographic erase) rather than a soft delete or flag, and set short TTLs on caches so prompt/output copies expire automatically.
- On session removal, issue a delete against the RAG vector index/embedding database keyed by the session or source identifier so embeddings generated from that conversation are removed or invalidated and can no longer surface in retrieval.
- Encrypt each session's prompts and outputs with a per-session key, and on deletion destroy that key (crypto-shredding) so any residual copies in immutable backups or replicas become unrecoverable.
- Set a bounded retention/expiry window on backups and replicas that contain session data, and document it so any copy of a deleted session is automatically purged within that window.
- Configure or contract the third-party model provider to delete the prompts and outputs they store and to exclude them from training/fine-tuning, and pull prompt/output text out of, or redact it from, application and audit logs so deletion of the session also clears those log copies.
Audit / evidence tips
- AskAsk for a live demonstration in which a known test chat session is deleted from the AI application, followed by queries against the primary session store, application cache and inference cache.Look atCheck whether any of the deleted session's prompts or outputs can still be returned from any of those stores after the deletion is triggered.GoodNone of the prompts or outputs can be retrieved from the session store, application cache or inference cache once the session has been removed.
- AskAsk for access to the RAG vector index or embedding database, along with a search by source-document or session identifier for a deleted session.Look atLook for embeddings derived from the deleted session's prompts or outputs and whether they remain searchable or retrievable.GoodVectors derived from the deleted session have been removed or invalidated so the deleted content can no longer be retrieved through the index.
- AskAsk for a restore of the most recent backup that contains a session deleted before the backup expiry window, and for the retention or key-management documentation covering backups.Look atSearch the restored copy for that session's prompts and outputs, and where any are found, check for a documented compensating control such as crypto-shredding of the per-session key or a stated backup expiry window.GoodEither the deleted session's data is absent from the restored backup, or a documented compensating control (per-session key destruction or a defined expiry window) demonstrably renders it unrecoverable.
- AskAsk for a walkthrough of the log pipeline, including samples from the application, inference and audit logs for a deleted session.Look atTrace whether full prompt and output text is written to any of those logs, and whether the log records for a deleted session are purged or redacted on the same deletion trigger.GoodFull prompt and output text is either not written to logs, or the corresponding log records are purged or redacted when the session is removed.
- AskAsk for documentation of the fine-tuning or training data pipeline, plus the model provider's data retention settings or contract terms.Look atConfirm that prompts and outputs from removed sessions are excluded or scrubbed from training corpora, and that the provider settings or contract state the vendor does not retain deleted prompts for training.GoodRemoved sessions are excluded or scrubbed from training data, and the provider configuration or contract confirms deleted prompts and outputs are not retained for training.
Cross-framework mappings
How ISM-2123 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.10 | ISM-2123 requires that all prompts and outputs associated with AI chat sessions are securely deleted when the chat session is removed fro... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.