What is Log Retention?

Every audit log takes up storage, and storage costs money. But deleting logs too early can be far more expensive. If a regulator requests evidence of agent activity from 18 months ago and you only retain logs for 12 months, you have a compliance gap. If a security incident is discovered months after it occurred and the relevant logs have been purged, you cannot investigate or demonstrate that your controls were operating.

Log retention requirements vary significantly by regulation. PCI DSS requires at least one year of audit trail history, with a minimum of three months immediately available for analysis. HIPAA requires six years for security-related documentation. Financial regulations like those governing broker-dealers may require seven years. SOC 2 doesn't specify a duration but requires that logs cover the audit period — typically 6 to 12 months.

For AI agents, log volume can be substantial. An active agent might make dozens of MCP tool calls per task, and each call generates a decision log entry. Multiply by the number of agents and tasks, and organisations can accumulate millions of log entries per month. Retention policies must balance compliance requirements against storage costs — often using tiered storage (hot/warm/cold) to keep recent logs readily accessible while archiving older logs to cheaper storage.

Intercept generates structured decision logs that can be forwarded to external storage with configurable retention. Because logs are emitted as structured events (JSON), they integrate with standard log lifecycle management — hot storage in Elasticsearch for recent logs, warm storage in S3 for intermediate retention, and cold storage in Glacier or equivalent for long-term compliance archives. Organisations configure retention at the storage layer rather than in Intercept itself, allowing different retention periods for different log types or compliance requirements.