Set log retention per log type, not as one number for everything. Security and audit logs usually need longer retention than debug output, and the right periods come from legal, contractual and investigation needs you should check for your own situation. Keep logs long enough to be useful and delete them when that time ends.
The two failure modes
Keep too little, and you cannot reconstruct an incident or answer an auditor. Keep too much, and you pay storage costs, widen what a breach could expose, and may break privacy commitments.
OWASP states both sides: log data, temporary debug logs and backups must not be destroyed before the required retention period, and must not be kept beyond it. It adds that legal, regulatory and contractual obligations may set these periods.
Sort logs into classes
A simple split works for most teams.
- Debug and diagnostic logs: help developers, often noisy, may contain more data than you intended. Short retention.
- Application and operational logs: used for troubleshooting and metrics. Medium retention.
- Security and audit logs: authentication, authorization, admin activity, access to sensitive data. Longest retention, with tighter access.
- Customer facing records: anything you must show a customer or regulator. Follow the specific rule that applies.
Where the numbers come from
Do not borrow a period from a blog post, including this one. Ask:
- Does a regulation you fall under name a period for this record?
- Do customer contracts promise a period or a maximum?
- How long do you typically take to discover an incident? Logs must outlast that gap.
- What does your privacy policy say about retention of personal data?
- Is there a legal hold that pauses deletion?
Where sources conflict, write down the decision and who made it. See our post on legal holds for the interaction between holds and periods.
Tiering to control cost
- Hot tier: fast, searchable, recent. Needed for live debugging and alert tuning.
- Archive tier: cheaper storage with slower retrieval, for older security and audit logs.
- Deleted: after the period, automatically.
Automate deletion. A manual cleanup that nobody owns turns a 90 day policy into an eight month reality.
Write it down
A retention table with log type, owner, location, period, reason and deletion method is a short document. Auditors like it, and so do new engineers. If you use a compliance platform, keep this table with your other policy evidence. Safeguard's compliance and evidence automation can store the policy and the proof that it runs.
Test deletion
Once a year, pick a log source and confirm that data older than the period is gone, including backups. A policy that is never tested is a wish.
Quick check
Can I just keep everything forever?
That is risky. It raises cost, expands what an attacker or a subpoena can reach, and may conflict with your own privacy commitments.
Do backups count?
Yes. OWASP names backups alongside logs, so include them in the retention schedule.
Sources
Related: legal hold vs retention period and audit evidence retention.
Last reviewed: 19 October 2026.
