Log retention policy is defined

NIST AU-11 (Audit Record Retention) requires that audit records be retained for a period consistent with the organization's data classification and applicable regulations. PCI-DSS Req 10.7.1 mandates a minimum one-year audit log retention. GDPR Art. 5(1)(e) requires that personal data not be kept longer than necessary for its purpose — meaning log retention also has a ceiling, not just a floor. Without a defined policy, teams either store logs indefinitely (accruing cost and compliance risk from retaining stale PII) or lose logs before an investigation needs them. A retention decision made during an incident is almost always wrong in one direction or the other.

Define log retention periods explicitly and configure them in your log service dashboard or as a scheduled cleanup job.

For log services, set retention in their settings UI: Better Stack dataset settings, Axiom dataset settings, or AWS CloudWatch log group retention.

Document the decision in docs/operations.md or your README:

## Log Retention
- Application logs: 90 days (Better Stack)
- Audit events table: indefinite until >10M rows, then archive to cold storage
- Retention rationale: PCI-DSS minimum 1 year for audit logs; 90 days sufficient for application logs

For audit log database tables, create a scheduled cleanup or archival job for records outside your retention window. If you're subject to PCI-DSS, the minimum for audit logs is 12 months with 3 months immediately available.