Hello Vercel team, I’m planning a media platform and considering Vercel Workflows for job coordination. Nothing is implemented yet. I’m seeking technical clarification only, not pricing or account changes. Original media would remain in private Cloudflare R2 storage, with application records in Neon. Workflows would hold minimal job references and status codes, which may still be linkable to a creator. Could you clarify these points with current documentation, exact limits and exceptions?

After early deletion of a finished run’s payloads, what is the maximum time until every copy—including encrypted backups—is erased? Can this be guaranteed within 30 days of the deletion request during an ongoing subscription?

Can individual run metadata, including linkable IDs, attributes and hook tokens, be erased within that period? What associated queue, observability and log records remain, and for how long?

Can steps use credentials and private source URLs transiently without automatically storing them through inputs, outputs, errors, HTTP instrumentation or telemetry? Which controls enforce this?

Is there a technical-only reference for current event, step, payload, hook, stream and storage limits? Which SDK/runtime versions support cancellation and terminal payload auto-deletion together? Please identify entitlement or experimental restrictions without prices.

What minimum permissions separately allow starting, observing, cancelling, decrypting and deleting run data? Is automated per-run cleanup available? What happens to already-running steps and external operations after cancellation?

Our planning requirement is to remove applicable residual copies within a further 30 days after final deletion. We understand that access expiry, encryption, cancellation and deletion are different. If a requirement cannot be met, please state that explicitly. Thank you.