Data retention policies for AI agent logs

AI agent audit logs contain a record of every action the agent takes. How long you keep these logs depends on your regulatory environment, operational needs, and storage budget. This guide covers retention requirements and implementation.

Regulatory minimums

Different regulations specify different minimum retention periods:

| Regulation | Minimum Retention | |-----------|------------------| | EU AI Act (Article 12) | Lifetime of the system, minimum 6 months | | SOC 2 | 12 months (audit period) | | HIPAA | 6 years | | GDPR | As long as necessary for the purpose | | PCI DSS | 12 months (3 months immediately available) | | SEC (financial) | 6 years |

If you operate under multiple regulations, use the longest applicable period.

What to retain

Not all log data has the same retention value:

Always retain: Policy decisions (allow, block, escalate), tool names, timestamps, principal identities, receipt hashes, and escalation outcomes. This is the core audit trail.

Retain with caution: Tool arguments may contain sensitive data (PII, credentials). You may need to redact or encrypt arguments before long-term storage while keeping the rest of the receipt intact.

Consider discarding: Debug logs, performance metrics, and temporary session state may not need long-term retention.

Implementation

Configure retention in the control plane:

const guard = createGuard({
  policy,
  receipts: {
    store: 'postgresql',
    connectionString: process.env.DATABASE_URL,
    retention: {
      default: '24months',
      highRisk: '7years',       // HIPAA, SEC
      arguments: 'redact_after_90days',
    }
  }
});

Argument redaction

To satisfy both audit and privacy requirements, redact sensitive fields after the short-term investigation window:

1. Store full receipts for 90 days (useful for incident investigation)
2. After 90 days, hash the argument values (preserving the receipt chain integrity)
3. Retain the redacted receipts for the full retention period

The hash chain remains verifiable even after redaction because the receipt hash was computed when the full data was present.

Immutable storage

For regulatory compliance, store receipts in append-only storage. Options include:

• PostgreSQL with no UPDATE/DELETE grants for the application role
• Object storage with retention locks (S3 Object Lock, GCS retention policies)
• Write-once media for archival

Deletion requests

GDPR gives users the right to request deletion of their personal data. This conflicts with audit retention requirements. The common approach is to redact personal data from the receipts while keeping the structural data (hashes, timestamps, decisions) intact. Consult legal counsel for your specific situation.

Storage costs

Hash-chained receipts are compact. A typical receipt is 500 bytes to 2 KB. An agent making 100 tool calls per day generates roughly 50-200 KB of receipt data daily. Even at 7-year retention, this is manageable for most organizations.