See how long each class of record is kept, what already sits past its window, and turn the six-hourly sweep on deliberately.

Settings → Data Retention answers three questions on one screen: how long each class of record is kept, how much already sits past that window, and whether anything is being deleted at all. On a new appliance the answer to the third is no — retention ships as a survey and deletes nothing until you turn it on.

What do I need?

Licence: Any
Role: superadminadmin_user

Prerequisites

The appliance has been in service long enough to hold records worth a policy — the panel leads with what is already past its window, and that number is the argument for the rest.
You sign in as superadmin. The dashboard lists this pane only for superadmin and for the read-only viewer role, although the API accepts admin_user for both reading and changing the policy.
You know your own statutory floor. CID222 refuses to enforce a security window under six months, but it cannot know your sector's longer one.
Your evidence is exported or backed up if you are about to shorten a window — the sweep deletes rows outright, with no recycle bin.

Screenshot pendingSettings → Data Retention showing 'Retention is not enforced', per-category windows with records past the window, and the Kept indefinitely list/assets/screenshots/settings-retention@0.4.png

What the policy covers, and what it never touches

Event log records fall into five categories, and the panel names each by what it holds rather than by its category code.

On the page	Category	Shipped window
API traffic	REQUEST	30 days
Slow queries and timeouts	PERFORMANCE	30 days
Detections, blocks and sign-ins	SECURITY	400 days
Exceptions and failures	ERROR	90 days
Configuration changes	AUDIT	365 days

The 400-day default on detection evidence is deliberate: a twelve-month SOC 2 Type II observation window plus roughly five weeks of audit lead time, which also clears with margin the six-month minimum the EU AI Act sets for deployers.

Four tables are surveyed and never swept — ai_content_detections, ai_document_analysis, ai_compliance_snapshots and ai_control_observations. They are the compliance evidence itself. The page lists them under Kept indefinitely so their growth is visible and the absence of a window is a stated fact rather than an omission.

Read the survey

Open the retention settings

Select Settings → Data Retention.

The banner reads Retention is not enforced or Retention is enforced. When it is not enforced and rows have aged out, it names the number: Nothing is being deleted. N records already sit past the windows below and are being kept.

Read the per-category rows

For each category the row shows the total record count and, where any have aged out, N past the window.

A window of 0 shows the tag Never deleted — that category's sweep is switched off, which is not the same as a window that has not been reached.

Check who set the current windows

Read the line at the foot of the form.

It reads Shipped defaults — nobody has set these yet. on an untouched appliance, and Set by username on date. once someone has saved. Untouched defaults follow the product across upgrades rather than freezing at install day.

Set the windows

Enter the days to keep

Type a number of days into the field beside each category. Enter 0 to stop deleting that class entirely.

A changed field is outlined until you save. The value must be zero or more.

Save

Select Save windows.

A toast reports Retention policy saved. and the survey recounts against the new windows.

Warning

While enforcement is on, a security window between 1 and 179 days is refused. The form warns before you try — Enforcement is on, so a SECURITY window under 180 days will be refused. Use 0 to stop deleting that class instead. — and a window under six months carries the tag Under 6 months.

Turn enforcement on

Danger

Enforcement is the moment records start being deleted, and deletion is permanent. Everything already past its window goes on the next sweep — the number the banner has been showing you. Export what you need first.

Confirm what will be removed

Read the N records already sit past the windows below figure, and the per-category N past the window counts.

That total is what the first sweep deletes.

Switch enforcement on

Set the Enforce switch to on.

The banner changes to Retention is enforced with Records past their window are deleted on a six-hourly sweep. The switch saves immediately; there is no separate confirmation.

The sweep runs every six hours from gateway start, and again when an on-demand route is called. It never deletes while enforcement is off: it counts what it would have removed, writes that to the container log, and leaves the rows in place.

Fields reference

GET /admin/logs/retention returns the whole survey.

Field	What it holds
`policy.enforced`	Whether the sweep deletes. Defaults to false, and stays false across an upgrade.
`policy.windows`	Days to keep, per category. `0` disables that category's sweep.
`policy.updated_at`, `policy.updated_by`	When the policy was last saved, and by whom.
`policy.source`	`seed` for the shipped defaults, `manual` once someone has saved.
`categories[].rows`	Total records held in that category.
`categories[].past_window`	Records older than the window. Always `0` when the window is `0`.
`categories[].oldest`	Timestamp of the oldest record in the category.
`unbounded[]`	The four compliance-evidence tables: row count and the age of the oldest row.

Changing the policy is PUT /admin/logs/retention. Two routes run the sweep on demand — POST /admin/logs/retention/sweep for an administrator and POST /admin/logs/cleanup for a superadmin — and both still delete nothing while enforcement is off. Neither has a button: the page changes the policy, and the six-hourly sweep acts on it.