When a user is under investigation, the vault has to be on legal hold, and no deletion or retention policies should apply to this vault. Does Vaultastic support a legal hold?

Yes, Vaultastic supports legal hold functionality. By default, all data in Vaultastic is immutable and read-only, with only the super-admin having the authority to delete entire vaults. Retention policies, if applied, can automatically delete older data. 

However, when a vault is marked for legal hold in Vaultastic, it becomes exempt from any retention policies and deletion actions, ensuring that the data remains fully intact and protected during investigations.