Data Retention

These are the default retention windows for Guard. Contact AutoRABIT Support if you need to discuss custom retention settings for your organization.

Compliance and audit records

These records have the longest retention windows to support multi-year compliance reviews and audit trails.

Feature	Default	What Guard keeps, and what happens when it expires
Change Log	5 years	Guard's record of every metadata change detected in your Salesforce org: what changed, when, by whom, any notifications Guard sent, and any baseline policy deviations it triggered. After 5 years, change entries are removed from the Change Log screens, exports and deviation history.
Guard audit trail	5 years	A versioned history of every edit made inside Guard itself: user accounts, connected hosts, subscriptions, saved queries, baseline policies, notification settings and AI usage limits. After 5 years, even the record that something was changed or deleted is gone permanently.
Code scan gate verdicts	5 years	The pass/fail decision for every pull request Guard evaluated. These are the compliance receipts that prove a merge was gated. Verdicts are kept for 5 years, well beyond the scan results themselves (6 months), so you can still answer "was this merge gated?" long after the scan has aged out.

Billing records

Feature	Default	What Guard keeps, and what happens when it expires
AI credit usage	13 months	The day-by-day record of AI credits consumed per feature. This is the data used for billing reconciliation. 13 months covers a full billing year plus a one-month buffer.

Feature history

These records power Guard's timeline views and trend analysis. After one year, historical states are not recoverable.

Feature	Default	What Guard keeps, and what happens when it expires
User Access Monitoring	1 year	Periodic snapshots of every Salesforce user in your org: their profile, permission sets, licenses and attributes at each point in time. After 1 year, access history cannot be recovered.
Risk Assessment	1 year	Results of Guard's recurring security posture scans: overall scores, identified risks and their state at each scan. After 1 year, trend charts and historical assessments are truncated. Your current assessment is always regenerated by the next scan.
API Security	1 year	Periodic inventories of connected apps and API access posture in your org. After 1 year, connected-app history is removed. The current inventory is refreshed by every new snapshot.
Data Classification	1 year	Guard's AI-driven analyses of which objects and fields in your org hold sensitive data. Only superseded analyses age out — the most recent analysis per org is always kept, regardless of age.
Drift Policy evaluations	1 year	The outcome of every drift policy evaluation: whether your org drifted from its expected state, which rules triggered, and what the values were. After 1 year, evaluation history is truncated. The policy itself and its configuration are kept indefinitely.
Transaction Security Policy events	1 year	Events ingested when a Salesforce Transaction Security Policy fires in your org (for example a blocked login or data export attempt). The event feed reaches back 1 year; your TSP policies are not affected.
Usage statistics	1 year	Operational counters showing Salesforce API and AI/LLM calls Guard made on your behalf, per feature. Used for consumption dashboards. Billing data is handled separately by the AI credit ledger above.
Digital Experience scans	1 year	Results of Guard scanning your Experience Cloud sites for public exposure. After 1 year, scan history is removed. Each new scan re-establishes the current exposure picture.

Operational data

Feature	Default	What Guard keeps, and what happens when it expires
CLI error logs	3 months	Error telemetry uploaded when a Guard CLI installation encounters a bug. Used by support and engineering to diagnose issues.
Code scan debug traces	3 months	Step-by-step scan traces the CLI can upload for support to diagnose a specific scan run. Deliberately shorter than scan results — a trace is only useful for recent runs.
AI response cache	2 months	Stored AI answers reused to avoid resending identical prompts. An expired cache entry has no functional impact — Guard recomputes the answer on next use.
Expired API keys	30 days	Keys that have passed their expiry date. The record is kept as a grace period during which an admin can still rotate the key. After 30 days, the key is deleted and a new key must be created and distributed to any pipelines using it.
Revoked API keys	30 days	Keys an admin has explicitly revoked. The record is kept for 30 days so the key list still shows what was revoked and when. Who revoked it remains visible via the audit trail for 5 years.

Temporary files

Housekeeping cleanups for files that can be regenerated.

Feature	Default	Notes
Generated export files	5 days	Reports and exports (CSV, Excel, PDF) held on disk until downloaded. Download links older than 5 days stop working; simply re-run the export.