To answer the last question first; correct, the recycle bins will eventually be emptied. How fast depends on admin settings, but you will never get more than (as I remember) 2 x 90 days out of it. So probably not enough for compliance/audit purposes. At least something to align in this case.
The way I see it there are a couple of options in this situation:
- Disable the possibility for users to delete anything. Not very user friendly tho.
- "Delete" documents with permissions, meaning that based on a value in the documents metadata, the permissions would be changed so that only admins can see them. A Power Automate workflow could assist in setting the permissions on the documents as they get the triggering value in the metadata.
- Monitor the recycle bin with a Power Automate flow, potentially also moving the documents from the recycle bin to a location where they are stored accoding to policy. They could then be approved by compliance officers before being permantly deleted.
I get from your question that option 3 is better suited in your situation, but I would also recommend to get the excact requirements from your business defined before setting for a solution. Like what are the precise compliance requirements :)