Designing breach settlement archive and long-term record retention UI in Figma: ARC-* packages, legal hold overlays, and read-only admin console

Quick answer

Archive UI preserves settlement records for years after portal closure—without keeping a live ops console running. Design ARC- archive packages* that snapshot CLM-, PAY-, court filings, and audit logs into immutable bundles with RET- retention schedules* and HLD- legal hold overlays* that block premature deletion. Admins get a read-only console for DSAR lookups, litigation discovery, and compliance exports—not day-to-day disbursement. Tie destruction workflows to proof of deletion and data retention policies. Start from the Figma guides hub and pair with tables, search UI, and Dev Mode handoff.

---

Who this is for

• Product designers building post-closure settlement systems where live claimant portals are gone but records must survive audits and litigation.
• Settlement administrators and legal ops managing retention schedules, legal holds, and discovery exports without reactivating PAY-* workflows.
• Compliance and privacy teams verifying destruction only happens when holds clear and regulatory minimums are met.

---

Archive lifecycle overview

ArchiveProgram — ARC-992-001 · settlement_id: SET-992 · Status: Active retention
├── Triggers:
│   ├── WIN-* hard close completed ([wind-down](/designing-breach-settlement-program-wind-down-and-portal-closure-ui-in-figma/))
│   ├── [Final accounting](/designing-breach-settlement-final-accounting-and-court-closure-ui-in-figma/) and court closure filed
│   ├── MON-* / AUD-EXT-* engagements closed
│   └── Admin initiates ARC-* packaging job
├── ID namespace:
│   ├── ARC-* (archive program) · PKG-* (immutable package bundle)
│   ├── RET-* (retention schedule) · HLD-* (legal hold)
│   ├── DSQ-* (discovery export request) · LOG-ARC-* (archive access log)
│   └── DST-* (destruction job) · PRF-DST-* (proof of deletion)
├── Package contents (PKG-* snapshot at archive_at):
│   ├── Claim registry (CLM-* summaries · redacted where required)
│   ├── Payment ledger (PAY-* · reconciliation refs)
│   ├── Court filings (RPT-*, FIN-*, regulatory archive)
│   ├── Audit logs (LOG-* across subsystems)
│   ├── Correspondence (NOT-* · call center transcripts if retained)
│   └── Config manifest (schema version · hash chain)
├── Access model:
│   ├── Read-only admin console — search · view · export
│   ├── Role-scoped: legal · privacy · finance · external counsel guest
│   ├── No edit · no re-disburse · no new CLM-*
│   └── All access LOG-ARC-* · break-glass for bulk export
├── Retention:
│   ├── RET-* per record class (claims 7y · payments 7y · logs 3y — jurisdiction-specific)
│   ├── HLD-* overrides RET-* until released
│   └── DST-* scheduled only when RET-* eligible AND no HLD-*
└── Outcomes:
    ├── PKG-* stored in WORM / object lock storage
    ├── Discovery exports on demand (DSQ-*)
    └── Destruction with PRF-DST-* when legally allowed

ARC state	Admin can	System does
Packaging	Monitor job progress	Snapshot · hash · seal PKG-*
Active retention	Search · DSQ-* export	Enforce RET-* · respect HLD-*
Hold review	View HLD-* impact	Block DST-*
Destruction pending	Approve DST-*	Countdown · final hold check
Destroyed	View PRF-DST-* only	Purge live copies · retain proof

Verdict: Archive is not backup—PKG- must be immutable, indexed, and legally defensible for e-discovery.*

---

ARC-* dashboard and PKG-* package browser UI

ArchiveDashboard — ARC-992-001 · pkg_count: 12 · oldest_retention_expires: 2033-06-01
├── Summary tiles:
│   ├── Total records archived · storage size · last DSQ-* export
│   ├── Active HLD-* count · records blocked from destruction
│   ├── RET-* expiring in 90 days (admin alert)
│   └── Integrity: last PKG-* hash verification pass
├── PKG-* package list:
│   ├── pkg_id · created_at · record_count · storage_class
│   ├── Contents summary (CLM · PAY · court · logs)
│   ├── seal_status (hash · signature · WORM lock)
│   ├── linked RET-* schedule · earliest destruction date
│   └── Actions: browse · verify integrity · export manifest
├── Package detail view:
│   ├── Manifest table (entity_type · id_range · file_ref · checksum)
│   ├── Browse by entity: CLM-* · PAY-* · RPT-* · LOG-*
│   ├── Redaction tier indicator (public summary vs full legal)
│   └── Download PKG-* subset (requires DSQ-* or role approval)
├── Search (cross-PKG-*):
│   ├── By CLM-* id · claimant email hash · payment ref
│   ├── Full-text on court filings · NOT-* subject lines
│   ├── Filters: date range · record class · hold status
│   └── Results show PKG-* source · retention · HLD-* badge
└── Integrity panel:
    ├── Scheduled hash re-verification job status
    ├── Mismatch alert workflow (incident · not silent fail)
    └── Storage replication health (if multi-region)

Pair search with privacy request queue patterns when DSAR arrives years after closure.

---

RET-* retention schedules and HLD-* legal hold UI

RetentionSchedule — RET-992-CLAIMS · record_class: claim_records · years: 7 · jurisdiction: US-CA
├── Schedule definition:
│   ├── ret_id (RET-*) · record_class_enum · retention_years
│   ├── trigger_event (archive_at · last_payment_at · court_closure_at)
│   ├── jurisdiction_ref · regulatory citation footnote
│   └── applies_to[] (CLM-* · EVD-* · correspondence)
├── Per-record countdown:
│   ├── eligible_destruction_at computed from trigger + RET-*
│   ├── Display on CLM-* archive view: "Destroy eligible: {date}"
│   └── Batch DST-* groups records by same eligible date
├── HLD-* legal hold overlay:
│   ├── hld_id (HLD-*) · matter_ref · counsel_contact
│   ├── scope: settlement-wide · CLM-* list · date range · record class
│   ├── placed_at · placed_by · reason_enum (litigation · regulatory · audit)
│   ├── Release requires: counsel approval · LOG-ARC-* · optional dual sign-off
│   └── UI: amber banner on affected records · blocks DST-* checkbox
├── Hold vs retention matrix (admin view):
│   ├── Record · RET-* date · HLD-* active? · effective destroy date
│   └── Export for legal monthly review
└── Policy conflicts:
    ├── Longest retention wins unless HLD-* extends further
    ├── Cross-border: show strictest jurisdiction badge
    └── Document override reason in LOG-ARC-*

Link to compliance exports and legal hold enterprise patterns for B2B admin consistency.

---

DSQ-* discovery export and guest counsel access UI

DiscoveryRequest — DSQ-992-0042 · requested_by: external_counsel · Status: Approved
├── Request intake:
│   ├── dsq_id (DSQ-*) · matter_ref · requesting_party
│   ├── Scope definition: CLM-* ids · date range · record classes
│   ├── Format: native · PDF load file · CSV index
│   ├── Privilege / redaction instructions
│   └── Approval workflow: settlement admin → legal → export
├── Export builder:
│   ├── Preview record count · size estimate · PII warning
│   ├── Redaction profile (mask SSN · bank · full name options)
│   ├── Bates numbering prefix · EXH-* style labels
│   ├── Generate async · email when PKG-DSQ-* ready
│   └── LOG-ARC-* every download · watermark PDFs
├── Guest counsel portal (time-boxed):
│   ├── USR-GST-* · expires_at · MFA · IP allowlist optional
│   ├── View only approved DSQ-* exports · no raw PKG-* browse
│   ├── Comment thread on export completeness (not edit records)
│   └── Auto-revoke at expires_at · extension requires new approval
└── Chain of custody:
    ├── Hash of DSQ-* output · signed manifest
    ├── Link to [forensic evidence](/designing-forensic-evidence-management-and-chain-of-custody-ui-in-figma/) patterns if dispute
    └── Store DSQ-* metadata even after DST-* destroys source records (where legal)

---

DST-* destruction jobs and PRF-DST-* proof UI

DestructionJob — DST-992-2026-Q4 · ret_id: RET-992-LOGS · Status: Pending approval
├── Job setup:
│   ├── dst_id (DST-*) · scope (record class · PKG-* subset · date eligible)
│   ├── Pre-flight checks:
│   │   ├── No active HLD-* on scope
│   │   ├── RET-* eligible_destruction_at passed
│   │   ├── No open DSQ-* using these records
│   │   └── Counsel sign-off if settlement-wide
│   ├── Dry-run: record count · sample IDs · hold exceptions list
│   └── Schedule execution_at (off-hours · maintenance window)
├── Execution UI:
│   ├── Progress bar · records purged · errors (should be zero)
│   ├── WORM unlock workflow (if storage requires)
│   ├── Generate PRF-DST-* certificate:
│   │   ├── dst_id · scope · executed_at · method_enum
│   │   ├── record_count destroyed · hash of destruction log
│   │   ├── signer_ids · immutable PDF + JSON
│   │   └── Stored in ARC-* meta-PKG (never destroyed)
│   └── Notify privacy team · update ROPA if linked
├── Post-destruction:
│   ├── Archive index updated (tombstone: "destroyed per DST-*")
│   ├── Remaining PKG-* integrity re-verified
│   └── DSAR response: "Records destroyed {date} per RET-*" with PRF-DST-* ref
└── Blocked destruction UX:
    ├── Explain which HLD-* or open DSQ-* blocks
    └── Link to release workflow · do not allow force without break-glass

Align with proof of deletion and right to erasure—archive destruction is not the same as live DSAR erasure, but UX should be consistent.

---

Read-only admin console vs live ops comparison

Capability	Live settlement ops	ARC-* archive console
Approve CLM-*	Yes	No — view only
Trigger PAY-*	Yes	No
Search claimant	Yes	Yes — LOG-ARC-*
Court export	Ad hoc	DSQ-* workflow
Delete records	Retention jobs	DST-* + PRF-DST-* only
User roles	Full admin	Legal · privacy · read-only
Portal phase	PH-* active/grace	Post WIN-*

---

Handoff checklist (Dev Mode)

• ArchiveProgram — arc_id (ARC-*), settlement_id, status_enum, packaged_at, storage_ref.
• ArchivePackage — pkg_id (PKG-*), arc_id, manifest_json, seal_hash, worm_locked_bool.
• RetentionSchedule — ret_id (RET-*), arc_id, record_class_enum, years_int, trigger_event_enum.
• LegalHold — hld_id (HLD-*), arc_id, scope_json, placed_at, released_at, matter_ref.
• DiscoveryRequest — dsq_id (DSQ-*), arc_id, scope_json, status_enum, output_ref.
• DestructionJob — dst_id (DST-*), arc_id, scope_json, status_enum, executed_at.
• ProofOfDeletion — prf_dst_id (PRF-DST-*), dst_id, certificate_ref, signed_at.
• ArchiveAccessLog — log_arc_id (LOG-ARC-*), user_id, action_enum, record_ref, timestamp.

---

Common mistakes

Mistake	Why it hurts	Fix
Archive = live DB read-only	Ops creep · security drift	Separate ARC-* storage
No PKG-* immutability	Spoliation risk	WORM · hash chain
Destroy on WIN-* close	Legal hold violation	RET-* + HLD-* gates
Bulk export without LOG-ARC-*	Audit failure	Per-download logging
One retention for all classes	Regulatory mismatch	RET-* per record class
Guest counsel full browse	PII overexposure	Scoped DSQ-* only
Silent hash mismatch	Data corruption undetected	Alert + incident workflow
DSAR says “deleted” without PRF-DST-*	Trust / compliance gap	Certificate in response
Re-open PAY-* from archive	Scope creep	Hard block · new program
No tombstone after DST-*	Confusion on lookup	”Destroyed per DST-*” index

---

Recommended workflow

1. Define RET- schedules* per jurisdiction and record class before WIN-* closes.
2. Build ARC- packaging job* UI with manifest, hash seal, and integrity verification.
3. Design search and PKG- browser* for legal and privacy lookup scenarios.
4. Add HLD- overlay* that clearly blocks DST-* with matter context.
5. Implement DSQ- export* with approval, redaction, and guest counsel time-box.
6. Prototype DST- + PRF-DST-** with pre-flight checks and counsel sign-off.

---

FAQ

How long to keep settlement records?

Jurisdiction-specific · RET-* encodes 7y financial / 3y logs as defaults · Legal sets actual · Document in manifest.

Active litigation after closure?

HLD- on affected scope* · DST-* blocked · DSQ-* may be frequent · Guest USR-GST-*.

Claimant DSAR years later?

Search ARC-* · Export if retained · If DST-* executed, respond with PRF-DST-* · Link DSAR portal patterns.

Can monitors access archive?

Usually admin-only · MON-* closed at WIN-* · Historical RPT-* already in PKG-* court section.

Reopen settlement for late claims?

New program · Do not mutate ARC-* · Import reference IDs only · Legal decision.

Storage cost UI?

Optional admin tile · PKG-* size · tiering to cold storage · Not claimant-facing.

---

Next steps

• Design breach settlement program wind-down and portal closure UI in Figma — Pre-ARC-* WIN-* handoff
• Design compliance exports and legal hold UI in Figma — HLD-* enterprise patterns
• Design proof of deletion and audit trail UI in Figma — PRF-DST-* certificates
• Design data retention policies and auto-deletion UI in Figma — RET-* policy engine
• Design forensic evidence management and chain of custody UI in Figma — DSQ-* chain of custody