Staff are currently discussing some matters behind the scenes concerning user security. I would like to ask you all to answer the following poll so we may make a more informed decision. Comments may be placed down below but we will not respond to inquiries. This poll is only asking for how long YOU need to retain data on-site.
I'm not sure how many Vendors operated as us on Silk Road but the reason we can't simply give a specific answer is we kept the conversations until whatever was discussed got resolved which varied wildly depending on the Topic at hand. So for example say a function to Label conversations were to be introduced with predefined options like "Answered", "Awaiting Information", "In Transit" etc. one could assign each Label a different Retention Policy based on how sensitive the Topic at hand is. Looking at it from purely a Security Perspective the riskiest conversations were those where one arranged a re-ship to Buyers without taking it to Resolution, when we were done shipping those and had deleted the Address it should have been considered an extremely High Risk Message compared to a casual conversation just answering some Questions about a Product. However Silk Road treated all messages the same as far as I know which means even the deleted messages with Addresses in them were Retained for three to five months.
While I'm not quite yet able to Conceptually describe how to intertwine the Communications Aspect into Orders this would solve it by being able to Deleting Sensitive Data instantly. What I mean by that is if a Buyer messages me about a re-ship it would be ideal if I could attach that message to the order so it updates the order-status by changing it from "in transit" to "reship" and then re-adds the order into the System as any normal Order with the Address specified - the Retention Policy for that message would then be until the instant that Order has been "Finalized/Completed".
Beyond Practical Solutions all the Options Listed are better than the 3-5 months Retention Silk Road utilized before. 
^ I like some of these suggestions ^
Messages should not contain any PII anyway, so there should not be any security risk associated with them - except in cases where there is a re-ship, or a last-minute address change/correction, and the buyer chooses to send their address in plaintext (which will happen, guaranteed).
In that instance it would be the responsibility of the buyer and the vendor to each manually delete that particular mail on both sides - which may or may not be done. As I see it the data-rentention policy only really needs to address these kinds of events from a security perspective.
Apart from that, and from the purely functional perspective of a vendor, longer is better. Ideally one would want to have access to messages for as long as a single order cycle takes to totally complete itself. If there is a re-ship involved this could go well beyond 28 days.
So I would say err on the longer side for functionality, but also address the security aspect that results from plaintext addresses being sent - perhaps even having another kind of "channel" available for the sending of addresses for re-ships (similar to the original "order" channel, where the message is deleted the moment the order is marked in transit) might be a solution.
If something like this was there and easy to use, people would likely make use of it - and thereby cut down, if not largely eliminate, the possibility of plaintext addresses lying about in messages longer than they need to.
If this aspect could be well-managed then it would allow for a more functional message retention policy, while still being secure. And good that you're keeping messages encrypted for a longer period as well.
BG
Poll