Keep a small evidence record per release: the image digest, the SBOM, the scan result at release time, the build record and the approval. Then the image itself can expire on your retention schedule without losing your ability to answer an audit or incident question.
Why separate the image from the evidence
An image is an operational artifact. It costs storage, can be pulled by mistake, and may carry known flaws as time passes. Evidence is a record of what you shipped and what you knew. They have different lifetimes. Binding them together forces you to keep old images just to prove something, or to lose proof when you clean up.
The record set
| Item | What it answers |
|---|---|
| Image digest and tag | Exactly what shipped, and when |
| SBOM | Which components were inside |
| Scan result at release | What was known at the time |
| Build record | Which source commit and pipeline produced it |
| Approval or gate result | Who or what allowed it to ship |
| Deployment record | Where and when it ran |
Each is small, text based and cheap to store. Together they answer the usual questions: were we exposed to that advisory, who approved this release, which customers ran this version.
Where to keep it
Store the record somewhere with its own retention, access control and integrity. Options include an evidence store, a release repository, or an SBOM platform. Avoid keeping evidence only as an attached artifact in the registry, since some registries expire attached artifacts with the image. Amazon ECR documents that reference artifacts expire within 24 hours after their subject image is deleted or archived. See does deleting an image delete its SBOM and signature.
How long
The period comes from your own obligations: customer contracts, your audit scope, your support commitments and internal policy. This is not legal advice, and no single figure fits everyone, so set it with your compliance owner and write it down. See how long to keep container scan evidence for audits and what to archive for each software release.
Make it automatic
A step at the end of the release pipeline can write the record, so no one has to remember. Run a periodic check that picks a random past release and confirms you can produce all six items. A sample test finds gaps before an auditor does.
Where Safeguard fits
Safeguard's SBOM and dependency scanning and its compliance and evidence automation are built to keep these records apart from your registry cleanup. A free scan is at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a single piece of evidence can be mapped to more than one requirement. That is why one well kept record is worth more than an old image.
Quick check
Do I need the image itself for an audit?
Usually the digest, SBOM, scan result and build record are what is asked for. Confirm with your auditor.
Who decides the retention period?
Your compliance owner, based on contracts, audit scope and policy. It is not set by the registry.
Sources
Last reviewed: 19 October 2026.
