Privacy and Immutability of Attachments in Requests

Good morning,

I have two questions about attachments handled in ServiceNow. Regarding privacy: I can restrict access to attachments. Not all attachments, so it can't be a general rule. There are certain Service Offerings that should have their attachments restricted to the Assignment Group, Requester, and the Requester's immediate manager.

Another behavior in attachment handling is the possibility of deleting attachments in RITMS. We also have some Service Offerings that, for legal reasons, need to maintain traceability and immutability of the documents attached to RITMS. The ServiceNow - Brazil partner that serves our company informed us that this is a standard platform behavior and could hardly be changed. Is this correct? Thank you.