Your Logs Keep Two Weeks. Singapore Law Says Five Years.

Two clocks run over the same agent action. One is set by whichever tracing plan your team happened to sign up for. The other is set by statute, and it does not move to suit a budget. Very few teams have put the two numbers next to each other.

AI agent log retention requirements

There is no AI-specific log retention period to comply with. What governs an agent's records is the record duty the firm already carries, applied to a new kind of record. In Singapore, a holder of a capital markets services licence must retain the books the Securities and Futures Act requires it to keep for not less than five years. Entry-tier tracing plans keep traces for days or weeks.

A holder of a capital markets services licence must retain such books as may be required to be kept under this Act for a period of not less than 5 years.

— Securities and Futures Act 2001, section 102(3)

Read the scope of that carefully before quoting it at anyone. It binds a holder of a capital markets services licence, and it binds the books that Act requires to be kept — not everything a system happens to emit. The instrument that applies to your own licence may set its own period, and the only safe way to know it is to open the instrument.

Now the other clock, taken from the vendors' own published plans. The free Helicone Hobby tier keeps 7 days. LangSmith base traces keep 14 days. The Braintrust Starter tier keeps 14 days, the Arize AX Free tier 15 days, and the Langfuse Cloud Hobby tier 30 days. Every one of those is an entry tier, and that qualifier is not a hedge — it is the whole accuracy of the sentence. Longer retention exists and is sold: extended traces on LangSmith run to 400 days, the Langfuse Pro plan to three years, and Helicone's enterprise tier is advertised as "Forever".

So the honest version of the gap is narrower than the headline and more uncomfortable. Nobody's product is careless. The retention window on most teams' tracing was chosen by a price point, and it has never once been checked against the period the business is actually bound to.

How long to retain AI decision logs?

Long enough to satisfy the record duty attached to the activity the agent took part in, and no longer than you can still justify holding the personal data sitting inside it. Those are two separate constraints pulling in opposite directions, and a policy naming only one of them is half-written.

The floor comes from the instrument that already binds the business. For a holder of a capital markets services licence in Singapore, that is not less than five years for the books the Act requires. Take the number off the instrument rather than off a vendor page or a conference slide, and do not carry a period across from another jurisdiction because the wording sounded similar.

The ceiling comes from the personal data. Under the Personal Data Protection Act, an organisation must stop retaining documents containing personal data — or strip the link between that data and the individuals it identifies — once it is reasonable to assume both that the purpose it was collected for has ceased to be served and that there is no remaining legal or business need to keep it.

The two limbs are joined by "and", and that conjunction carries most of the weight. A live statutory duty to keep a record is exactly the legal need the second limb preserves, so privacy law and record-keeping law are not in conflict here. Anyone whose policy says "we have to delete it, privacy rules" has read one limb and stopped. What the obligation does rule out is the other habit: keeping everything forever in case a regulator ever asks. Indefinite retention of customer personal data needs a reason that survives being asked for one.

There is a second timing problem sitting underneath the first. A retention window starts when the trace is written. The reason anyone eventually wants that trace — a customer complaint, a dispute with a counterparty, an internal review, a question that arrives in writing — turns up on its own schedule, and nothing about that schedule is aligned to a billing tier. By the time the record is asked for, the decision about whether it still exists was taken by default, silently, a long time earlier.

LLM trace retention compliance

Most retention numbers quoted in this debate are attached to the wrong object. The agent frameworks — LangGraph, CrewAI, AutoGen, the OpenAI Agents SDK — retain nothing at all. They emit. Retention is a property of the backend you point them at and of the plan you happen to be on at that backend.

That cuts both ways, and the second half is the part usually left out. A self-hosted Langfuse deployment stores its data indefinitely by default, which is far closer to what a regulated institution would actually run than any hosted free tier. If you host it yourself, the days-and-weeks problem is not your problem. You have the opposite one: an unbounded store of customer prompts and outputs with no expiry, and often no written justification for keeping any of it.

Which means "is our tracing stack compliant" is not a question about a product name. It is three checks, and all three can be done this afternoon: which backend receives the traces, which plan that backend is on, and what the retention setting on that plan is right now.

Agent observability data retention policy

A usable policy states a floor, a ceiling and a split. The floor is the record duty. The ceiling is the point past which holding the personal data can no longer be justified. The split is the part almost nobody writes down: which parts of a trace are a record of what the business did, and which parts are engineering telemetry that can be dropped early without touching either duty.

The split is what makes the arithmetic survivable. A full trace of every step, every prompt and every intermediate result is expensive to hold for years and, for most of its bulk, pointless to hold for years. The record is much narrower — what the agent was asked to do, what it proposed, what was actually permitted, on whose authority, and what was then carried out. Keeping that for a five-year period is a different order of cost from keeping everything for a five-year period.

Write the tier into the policy as well. An entry-tier retention window is a fact about your billing rather than a fact about your governance, and it will change quietly the next time somebody opens a fresh account for a new project. A policy that names a period but not the plan enforcing it is describing an intention.

Do AI audit logs meet record keeping rules?

Retention is necessary and it is not sufficient. Holding a trace for five years settles only whether the record still exists. It settles nothing about whether a person outside your team should believe what it says.

A debugging trace is built for a reader who trusts it. It exists so that an engineer can work out why something behaved oddly, and every design decision inside it assumes the reader is on the same side as the system. An evidence record is read by somebody starting from the opposite assumption — that you had the access, the motive and the opportunity to change it before they ever saw it. That is not cynicism on their part. It is the job.

This is why the honest answer to "do our AI logs meet record-keeping rules" is usually "not yet, and not for the reason you think". Ordinary application logs can be edited by the same people who operate the system, so a record that can be changed without the change showing leaves an examiner precisely where they started. Tamper-evident records do not prevent alteration. They make alteration detectable, which is the property that carries weight when the reader does not have to take your word for anything.

Two earlier pieces work through that distinction in more detail: what makes an AI audit log verifiable rather than merely stored, and how an audit trail behaves once it is read in a liability dispute.

What this means if you have to produce evidence

Five steps, none of which require buying anything.

1. Find the instrument that already binds the activity your agent takes part in, and read the period off it. For a holder of a capital markets services licence in Singapore that is not less than five years for the books the Act requires. Do not carry a period across from a neighbouring market.
2. Ask what your current tracing plan retains today, not what the vendor's top tier could retain. Across the mainstream backends the published entry-tier windows run from 7 to 30 days, and the upgrade is a purchase decision somebody has to actually make.
3. Separate record from telemetry and give them different lives. This is the single change that makes a multi-year duty affordable.
4. Write the ceiling into the same document. Personal data inside a trace has to stop being retained once no purpose is left to serve and no legal or business need remains.
5. Then ask what retention cannot answer. If this record survives five years and is handed to somebody who assumes it may have been edited since, what in it shows that it was not?

Crelis builds records meant to be read by that second kind of reader; the design partner programme is set out on the Greenlight page. The company holds no security certification and says as much on its security page. None of the arithmetic above depends on that, though. The instrument is public, the plan you are on is visible from your own billing screen, and the subtraction takes about ten minutes.

Related reading

• AI audit logs: verifiable rather than merely stored
• An audit trail read in a liability dispute
• More on observability
• More on financial services
• What Crelis does and does not hold
• The Greenlight design partner programme