“How long do we need to keep the logs?” is one of those questions that sounds like a storage decision and turns out to be a legal one. It is usually asked late — during a vendor security review, or a week into an incident, when someone needs to know what a model was asked in March. The honest answer is that there is no single number, and the range is much wider than most teams assume.
The regulators don't agree on a number
Retention floors are set by whichever regime applies to you, and they are not close to each other.
- The EU AI Act sets a six-month floor. Article 19 requires providers of high-risk AI systems to keep automatically generated logs for a period appropriate to the system's intended purpose, and at least six months, unless other Union or national law says otherwise. The bulk of the Act's obligations apply from 2 August 2026.
- HIPAA's floor is measured in years. The Security Rule requires the documentation it mandates to be retained six years from creation or from its last effective date, whichever is later — a period that keeps running well past the events it describes.
- GDPR pulls in the opposite direction. The storage-limitation principle says personal data should not be kept longer than necessary for the purpose. It sets no fixed period, and for some records it is an argument to keep less.
Sector rules layer on top of all of this — financial-services record-keeping obligations, national law, and contractual commitments to your own customers routinely push the requirement further out. The practical spread runs from six months to six years and beyond, in opposite directions, and which end you land on depends on facts about your business that may change after you have already configured the system.
Retention is decided after the incident, not before it. The question is never “how long do we want to keep this?” — it's “how far back can we look?”, asked by someone who does not care what your log settings were six months ago.
A retention cap is a security problem, not a billing detail
The reason this matters more for AI logs than for ordinary application logs is that AI incidents are discovered late. A leaked credential in a prompt, a model quietly drifting toward bad outputs, an employee routing customer data through an unapproved tool — none of these announce themselves. They surface when a customer asks a question, when a security researcher files a report, or when an auditor pulls a sample. By then the interesting activity is months old.
An audit log that expires on a timer is therefore a strange thing to own: it is a control that works perfectly right up until the moment you need it most, and its failure mode is silent. Nobody gets an alert saying “the evidence for the incident you have not yet discovered was deleted last night.” You simply find, later, that the window closed.
Which is why tying that window to a pricing tier is worse than it first appears. It converts a compliance and forensics decision into a budget decision, and it puts the vendor's revenue model on the opposite side of the customer's interest. The smallest customers — the ones least likely to have a dedicated compliance function, and least likely to notice — get the shortest memory.
What we changed
We shipped that design, and we no longer think it was defensible. Until this month, WeeBie Monitor enforced audit-log retention by licence tier: roughly a month on Starter, a year on Business, unlimited on Enterprise, with a daily job deleting anything older.
As of July 2026, that enforcement is removed entirely. Audit-log retention is now unlimited on every tier, including the cheapest one. Nothing is auto-deleted, and no plan, licence, or entitlement can cause an audit record to be removed. The only limit is your own disk.
If your own regulator requires history to expire — a data-minimisation obligation, or a retention schedule your DPO has committed to — you can opt into a retention window yourself. That is available on every tier, it defaults to keeping everything, and it is your decision rather than ours. A GDPR erasure request behaves the same way it always did: it removes the subject's operational records while retaining their audit entries, and the chain still verifies afterward.
Why we could do this
Because the software is self-hosted, and that changes the economics completely.
WeeBie Monitor runs inside your infrastructure. The audit log is written to your database, on your hardware, inside your perimeter. We never receive a copy of it, we never store it, and we pay nothing to keep it. Charging you by the month for retention length would have meant charging you for storage we do not provide — a fee attached to your own disk.
That distinction is worth stating plainly, because it is where the line between free and paid actually sits. The tamper-evident hash chain, cryptographic verification of that chain, the compliance evidence reports drawn from it, and export into your SIEM remain paid, tier-gated capabilities. Those are work the product does. The length of the log is not work the product does — it is a property of your storage. We charge for what we do with your audit trail, not for permission to keep it.
What to actually do about retention
Whatever gateway you run, a few principles hold:
- Default to keeping. Storage is cheap and comes down every year; reconstructing an incident from logs you deleted is impossible at any price. Make expiry a deliberate act, not a default.
- Separate operational retention from audit retention. Cost rows, cached responses, and metrics can be pruned aggressively without touching the audit trail. Treating them as one setting is how audit history gets thrown away to save space that the metrics were using.
- Write the expiry decision down, and say why. If you do set a window, tie it to the specific obligation that requires it. “Ninety days because that is what the plan included” is not a policy anyone can defend later.
- Make sure the log can prove it wasn't edited. Retention is only half of the question an auditor is asking. A long log that anyone with database access could quietly rewrite answers “how far back” but not “can we trust it”; a hash chain answers both.
- Check what your vendor's caps actually are. Read the retention row on the pricing page, not the feature bullet. If the log expires, find out what happens to the evidence at the boundary — and whether you can turn it off.
The record is yours
An audit trail is the one artifact that has to survive everything else — the incident, the staff turnover, the migration, the acquisition, the auditor who arrives three years later asking about a decision nobody remembers making. It is the organisation's memory of what its AI actually did.
That record should not have an expiry date set by a pricing page. It is your data, on your hardware, and how long you keep it is your call.