Data Retention
Overview
ET Ducky keeps three kinds of data, on three kinds of schedule:
- Telemetry and activity history: events, health and hardware readings, correlations, fired alerts, live sessions, shell output, file transfers and remote desktop sessions. Your retention tier sets how long these are kept. Every organization starts on the free 14-day tier; the Extended, Annual and Maximum tiers keep them for 90, 365 or 730 days.
- Records with a fixed window: inventory snapshots, the audit log, connection logs and a few internal records. Their windows are the same on every tier.
- Your organization's records: tickets, knowledge base articles, scripts, automations, alert rules, detections and the command audit trail. These are kept for as long as your organization exists, on every tier, including the free tier.
The sections below list what falls under each schedule, so you can see exactly what a paid retention tier adds.
Retention Tiers
| Tier | Retention | Price | Best For |
|---|---|---|---|
| Free (Default) | 14 days | $0 | Active troubleshooting |
| Extended | 90 days | $0.50/agent/month | Monthly trend analysis, short-term compliance |
| Annual | 365 days | $1.50/agent/month | Annual compliance, performance baselining |
| Maximum | 730 days | $2.50/agent/month | Audit requirements, long-term capacity planning |
Annual billing: Save 15% on retention costs, same as all other subscriptions.
How Billing Works
Per-Agent Pricing
Retention is billed per registered managed agent in your organization. Desktop agents that sync to the cloud are included. The quantity on your Stripe subscription updates automatically when agents are added or removed, with no manual adjustments needed.
Example Costs
| Agents | Extended (90d) | Annual (365d) | Maximum (730d) |
|---|---|---|---|
| 10 | $5/mo | $15/mo | $25/mo |
| 50 | $25/mo | $75/mo | $125/mo |
| 200 | $100/mo | $300/mo | $500/mo |
What Your Retention Tier Controls
These data types are kept for your tier's window: 14 days on the free tier, 90, 365 or 730 days on a paid tier.
| Data | What it includes | Notes |
|---|---|---|
| Events | ETW events, event batches and event summaries sent by your agents | Removed in weekly blocks, so an event can remain up to 7 days past the window. |
| Health metrics | CPU, memory, disk, network and the other health readings | Individual samples are kept for 14 days on every tier. Paid tiers also keep 5-minute summaries (average, minimum and maximum) for the full window. See Health summaries. |
| Hardware readings | Temperatures, disk wear, battery health and charge, thermal state | Paid tiers also keep 15-minute summaries for the full window. Removed in weekly blocks, like events. |
| Correlations and patterns | Correlation analyses, detected patterns and correlated event summaries | |
| Fired alerts | The alert history: each time a rule fired, its details and any AI enrichment | An alert still open at the end of the window is removed too; if its condition still holds, the rule fires again on its next check. Your alert rules themselves are kept (see below). |
| Live and multi-agent sessions | Sessions, the questions asked in them, session events, commands and progress | Includes sessions of agents you have since deleted. |
| Shell command output | The output (stdout and stderr) of commands run on an agent | Only the output is removed. The record of the command (who ran it, when, on which agent, the command and its exit code) is kept as the audit trail. |
| File transfers | The transfer record and the transferred file stored on ET Ducky's servers | Both are removed. |
| Remote desktop sessions | The record of each remote desktop session |
Data older than the window is permanently removed during the daily maintenance window (3:00 AM UTC). Data from agents you have deleted is removed on the same window.
Health summaries
On the Extended, Annual and Maximum tiers, ET Ducky keeps 5-minute summaries of health readings and 15-minute summaries of hardware readings for the full retention period, alongside the 14 days of individual samples. Smart Reports and the Data Explorer use these summaries for ranges longer than 14 days. Summaries start from the day the tier is active; samples already older than 14 days when you upgrade are not summarised.
What a paid tier adds
- Events, alerts, correlations, sessions, shell output, file transfers and remote desktop records stay available for 90, 365 or 730 days instead of 14.
- Health and hardware history beyond 14 days, as 5-minute and 15-minute summaries.
- Reports, Smart Reports, Historical AI Analysis and the Data Explorer can only query data that is still kept, so a longer tier lets them look further back.
A paid tier does not change the records in the next two sections: those are kept for the same time on every tier.
Records With a Fixed Window
These are kept for the same period on every tier.
| Data | Kept for | Notes |
|---|---|---|
| Inventory snapshots (installed software, services, listening ports and the other inventory an agent reports) | 90 days | The newest snapshot of each agent is always kept, however old. |
| Application behaviour observations (the raw readings behind each application's learned profile) | 30 days | The learned profile itself is kept. |
| Audit log (remote actions such as shell commands and remote desktop, configuration and settings changes, and the other entries in the audit log) | 12 months | |
| Authentication and connection logs | 12 months | See Agent network identity and connection logs. |
| Command delivery records (how each command reached an agent) | 7 days after the agent confirms the command, or until the command expires | Internal record used to deliver commands reliably; the command's own record (for example the shell command) is kept as described elsewhere on this page. |
| Credentials of deleted agents | 365 days | Kept so a deleted agent that tries to reconnect is recognised and refused. |
Kept for the Life of Your Organization
No retention tier or automatic purge removes these. They stay available on every tier, including the free tier, until you delete them or delete your organization.
- Tickets and ticket notes, including archived tickets, and time entries.
- Knowledge base articles. Screenshots that no article uses any more are removed after 24 hours.
- Scripts and script repositories, automations and their run history, alert rules and their notification channels.
- Patch job history and troubleshooting jobs.
- Smart Reports and Historical AI Analysis history: the questions asked and the answers returned. The underlying data they queried follows its own retention.
- Security incidents.
- The detection and command audit trail: behavioural detections, anomalies (inflections), the record of each shell command (without its output, which follows your tier), and the history of applications installed, updated or removed on each agent. These are kept so an incident review or an insurer can see what happened, however long ago.
- Agent records (name, platform, version, last heartbeat) until you delete the agent.
Deleting an agent removes its record and network identity; its telemetry is then removed on your tier's window. Deleting your organization removes all of its data, including tickets.
Agent Network Identity & Connection Logs
Handled separately from the telemetry tiers above: each agent's registration source IP, most-recent (last-seen) connection IP, and device identifiers (machine/MAC/disk identifiers, timezone, locale) are stored on the agent record and are removed when the agent is deleted. Authentication and agent-connection logs that include source IP, and logs of connections that presented an invalid or revoked credential, are retained for security and abuse-prevention purposes for 12 months. These are not subject to the per-tier purge window.
Security & Fraud Signals
Held separately and used only for security, fraud prevention, and abuse detection: limited payment metadata (a non-reversible card fingerprint and billing country, never full card details), account registration context (sign-up IP and device characteristics), and threat indicators observed in evaluated commands. Payment metadata is kept for the life of the account and a limited period afterward for accounting and legal-claim purposes; the rest are retained for security purposes and are not subject to the per-tier purge window.
Security / Legal Hold
Data associated with a security incident or a banned account may be placed on a legal/security hold. While held, that data is preserved as evidence, exempt from the purge windows above and not deleted on ban.
How a hold ends depends on how it was placed:
- Automatic holds: placed by the platform when a security incident is raised. These release themselves 365 days after they were placed, at which point the organization returns to its normal retention tier and the next nightly purge treats it like any other. An administrator can release one sooner at any time.
- Manual holds: placed by an administrator. These never expire on a timer and stay in force until an administrator releases them.
Because a held organization is skipped by every purge, its data keeps accumulating past its retention window for as long as the hold is in force. The first purge after a long hold ends may therefore remove a large amount of data at once.
Managing Retention
Purchase or Upgrade
From the Dashboard, use the Data Retention card or the Manage Data Retention button in Quick Actions. Select your desired tier and complete checkout via Stripe. Upgrades take effect immediately.
Downgrade or Cancel
Use Manage Billing / Cancel in the retention modal to open your Stripe billing portal. Downgrades and cancellations take effect at the end of the current billing period. After cancellation, retention reverts to the free 14-day default.
Custom Overrides
Enterprise customers can request per-data-type retention overrides (e.g., 365 days for events but 90 days for session data). Contact support to configure custom retention policies.
Self-Hosted Deployments
Data retention add-ons apply only to cloud-hosted (etducky.com) deployments. Self-hosted instances manage their own database storage and retention policies; there is no automatic purge service or per-agent billing for self-hosted data.
A self-hosted server keeps its own log files in the logs volume (/app/logs in the api container). Each file holds one day as JSON lines. The server keeps 90 daily api- files and 366 daily audit- files and deletes older ones as new files are written. See Self-Hosted Deployment for what each file contains.