Logs retained min 7 years per SOX/GLBA

SOX §802 (Criminal Penalties for Altering Documents) makes it a federal crime to destroy or alter audit records within the 7-year retention window — and it applies to the company even if deletion was caused by an automated TTL policy that a developer configured without understanding the requirement. GLBA 16 CFR Part 314 (Safeguards Rule) requires covered financial institutions to retain records related to the security program. NIST 800-53 AU-11 requires organizations to retain audit logs for a defined period consistent with their records retention policy. PCI-DSS 4.0 Req-10.7 requires that audit log history is retained for at least 12 months, with at least the most recent three months available for immediate analysis — financial services are typically subject to the more demanding SOX/GLBA 7-year window. A TTL policy set to 3 years deletes legally protected records and creates criminal liability for the company.

Define an explicit retention policy in infrastructure/retention-policy.yaml or your database migration. Never rely on the absence of a TTL as implicit retention — document it explicitly:

# infrastructure/retention-policy.yaml
audit_logs:
  table: transaction_logs
  retention_years: 7
  min_days: 2555
  hot_storage_years: 1      # live DB
  warm_storage_years: 3     # read replica / compressed
  cold_storage_years: 3     # S3 Glacier, encrypted
  deletion_allowed_after_days: 2555
  ttl_attribute: null       # no auto-delete

For DynamoDB, ensure no TTL attribute is set on the transaction table. For PostgreSQL, use partitioning to move old partitions to cheaper storage without deleting them. S3 Lifecycle rules must be configured with a 30 days to IA → 365 days to Glacier → no Expiration policy on the audit log bucket.