Retention and export
How long audit entries live, what happens to them when the actor or resource goes away, and how to get a copy.
Audit entries are kept for as long as the organization exists. No retention window is enforced and no job deletes them, which is a different statement from a committed retention promise, and the difference matters if you are writing a compliance answer.
No retention period is committed
Nothing prunes audit entries today, so entries from your organization's first day are still there. That is the current
implementation rather than a guarantee. If your compliance program needs a stated retention period, ask
cs@gigadrive.de before relying on it.
Runtime logs are the opposite case: those are pruned at 30 days. See Runtime logs for that, and do not carry the number across.
What survives a deletion
An entry names the actor and the target by id. Those references are deliberately weak, so the history does not evaporate when the thing it describes does.
| If this is deleted | The entry |
|---|---|
| The user or actor that made the change | Keeps actorDisplayName and loses actorId |
| The API key that was used | Keeps the rest and loses apiKeyId |
| The resource that was changed | Keeps targetType, targetId, and targetDisplayName, all captured at the time |
| The organization, which has no self-service delete | Cascades, and the entries go with it |
The display names are why this works. An entry records what a bucket or a variable was called when it was touched, not a pointer that resolves to whatever the name is now.
Export
There is no export endpoint, no CSV download, and no SDK resource. Write to cs@gigadrive.de with your organization id and the period you need.
What is never in an entry
Secrets. An environment variable entry records the key and its sensitive flag, an API key entry records the key's name and id, and neither carries the value. The payload field exists for the fields that make a change intelligible, and services choose what goes in it deliberately.
Request context is captured, so entries do contain the IP address, user agent, and country of the request that produced them. Treat an extract as personal data.