Audit & Traceability
Archive and retention
How long events are kept and how to archive them.
Compliance evidence often has to outlast the time SecureAuth keeps it. SecureAuth keeps audit events for three months, so you keep anything longer by forwarding events to your own system as they happen.
How long SecureAuth keeps data
- Audit events – three months, then SecureAuth deletes them automatically.
- LLM telemetry – three months, the same as audit events.
- Resolved anomalies and resolved findings – 120 days, then SecureAuth removes them.
Keep events longer
A webhook on Event Forwarding sends each audit event to an external system as it happens. That system keeps its copy for as long as you choose, outside the three-month window. Forward to a SIEM, a log store, or any HTTPS endpoint, and narrow a webhook to the event types you need. Check the webhook's deliveries, because an event the destination never received is not kept anywhere else after three months.
To set up forwarding, see Event forwarding.