To comply with privacy laws we can't keep session data and especially the session devices for too long after the session has expired. How do you guys solve this?

Use the Kratos cleanup command, it does not look like it is well documented... here is the code it is calling: https://github.com/ory/kratos/blob/e5d3b0afde3c80c6c9cf8815c56d82e291ede663/persistence/sql/persister.go#L189

I found the https://www.ory.sh/docs/kratos/cli/kratos-cleanup-sql corresponding docs. I suppose there is no API/sdk counterpart (yet)?

no this has to run as a separate job, and it can take quite long so no real use-case for an api

Got it. Thanks for clarifying