Canonical answer maintained by the knowledge admin. Used by AI drafting to seed RFP draft v1.
Application logs 90 days hot, 7 years cold (S3 + Glacier). Audit logs 7 years. Authentication logs 1 year. Logs are streamed to a centralized SIEM with anomaly detection.