Identity, KYC, and transaction records are handled as restricted operational data.

Application records are currently stored in a local operational data layer for this deployment. For long-term scale, records should move to encrypted managed infrastructure with audited access control and formal retention policies.