{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T12:55:40.483Z",
  "record_id": "VXI-EXT-PROCUREMENT-KEYVAULT-PURGE-01-v1",
  "record_kind": "external_reference",
  "title": "Key Vault recovery: Soft delete and purge protection",
  "system": "Azure Key Vault",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does recovering a Key Vault restore every surrounding integration?",
  "near_questions": [
    "Is soft delete the same as purge protection?",
    "Can purge protection be disabled after enabling it?",
    "Which retention interval applies?",
    "Can the vault name be reused during retention?",
    "Does recovering a vault restore role assignments?",
    "Are Event Grid subscriptions restored automatically?",
    "Who can recover or purge objects?",
    "Does recovered material prove applications can read it?",
    "Which dependencies need reconfiguration?",
    "Is object recovery separate from service recovery?",
    "What evidence should procurement require after a restore?",
    "Can I preserve the reviewed recovery scope?"
  ],
  "supported_claims": [
    {
      "claim": "Soft deletion retains recoverable vault objects for a configured interval, and purge protection prevents early permanent removal during that interval. Recovering the vault does not automatically restore associated Azure RBAC assignments or Event Grid subscriptions. Recovery of secret material and recovery of the surrounding service are separate checks.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Soft deletion retains recoverable vault objects for a configured interval, and purge protection prevents early permanent removal during that interval. Recovering the vault does not automatically restore associated Azure RBAC assignments or Event Grid subscriptions. Recovery of secret material and recovery of the surrounding service are separate checks.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Key Vault soft deletion and purge protection",
    "source_url": "https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-KEYVAULT-PURGE-01-v1",
    "candidate_record_sha256": "c36dad919102242aaa4597f63b4aaa8f1814f5f614ab1c5c0f202b6f88c206f7",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Soft deletion retains recoverable vault objects for a configured interval, and purge protection prevents early permanent removal during that interval. Recovering the vault does not automatically restore associated Azure RBAC assignments or Event Grid subscriptions. Recovery of secret material and recovery of the surrounding service are separate checks.",
    "required_buyer_context": "Vault identity, retention, purge protection, RBAC assignments and dependent event subscriptions. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Soft-delete recovery restores the entire integrated service automatically.",
    "documented_statement": {
      "status": "documented",
      "statement": "Soft deletion retains recoverable vault objects for a configured interval, and purge protection prevents early permanent removal during that interval. Recovering the vault does not automatically restore associated Azure RBAC assignments or Event Grid subscriptions. Recovery of secret material and recovery of the surrounding service are separate checks.",
      "source_ids": [
        "keyvault"
      ]
    },
    "buyer_evidence_required": [
      "Vault retention and purge-protection settings.",
      "Recovered objects and required permissions.",
      "RBAC and event-subscription restoration evidence."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require integration verification before declaring the recovered service operational."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "keyvault",
        "url": "https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview",
        "final_url": "https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview",
        "title": "Key Vault soft deletion and purge protection",
        "checked_on": "2026-10-16",
        "sha256": "58049cd373b12ef82f84ca84cbbc6537be72cf7a9df64e6f26cea63089ee974d",
        "bytes": 57956
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save a recovery checklist grounded in the documented limits of vault restoration.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Vault identity, retention, purge protection, RBAC assignments and dependent event subscriptions."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#key-vault-recovery-not-complete-restoration",
  "machine_readable_record": "/varexis-index/records/key-vault-recovery-not-complete-restoration.json"
}