By default, Google retains twelve months of your data in your Google Security Operations
account. This retention period can be extended as part of your Purchase Order.
The retention period applies to all of the data in your Google SecOps
instance. For example, you can't modify the data retention policy for a specific
log type.
Google uses an automated system to remove historical data based on event and
detection timestamps.
View your data retention start date in Google SecOps
The Data Retention page is a read-only section within the SIEM settings that
shows the date when data retention began for your account.
To view your data retention start date, follow these steps:
In the navigation bar, select Settings and click SIEM Settings.
The SIEM Settings page displays all settings relevant to
SIEM.
Under Environment, click Data Retention.
The Data Retention page displays the retention start date in yyyy-mm-dd
format.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eGoogle Security Operations retains data for twelve months by default.\u003c/p\u003e\n"],["\u003cp\u003eThe data retention period can be extended beyond twelve months as part of a purchase order.\u003c/p\u003e\n"],["\u003cp\u003eThe retention policy applies to all data within the Security Operations instance, and cannot be modified for specific log types.\u003c/p\u003e\n"],["\u003cp\u003eGoogle uses an automated system to remove old data, based on the event and detection timestamps.\u003c/p\u003e\n"]]],[],null,["# Data Retention in your Google SecOps account\n============================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nBy default, Google retains twelve months of your data in your Google Security Operations\naccount. This retention period can be extended as part of your Purchase Order.\nThe retention period applies to all of the data in your Google SecOps\ninstance. For example, you can't modify the data retention policy for a specific\nlog type.\n\nGoogle uses an automated system to remove historical data based on event and\ndetection timestamps.\n| **Note:** It may be possible to see extended events at the margins of the retention period. For example, if a detection includes component events marginally older than the retention period.\n\nView your data retention start date in Google SecOps\n----------------------------------------------------\n\nThe **Data Retention** page is a read-only section within the SIEM settings that\nshows the date when data retention began for your account.\n\nTo view your data retention start date, follow these steps:\n\n1. In the navigation bar, select **Settings** and click **SIEM Settings** .\n The **SIEM Settings** page displays all settings relevant to\n [SIEM](/chronicle/docs/secops/google-secops-siem-toc).\n\n2. Under **Environment** , click **Data Retention**.\n\nThe **Data Retention** page displays the retention start date in *yyyy-mm-dd*\nformat.\n\nFor more information on data retention, see\n[View data retention in your Google SecOps account](/chronicle/docs/about/data-retention).\n| **Note:** By default, Google retains your data for 12 months in your Google Security Operations account.\n\nThe **SIEM Settings** page displays all settings relevant to\n[SIEM](/chronicle/docs/secops/google-secops-siem-toc). Under **Environment** ,\nclick **Data Retention**.\n\nTo learn about where data in the Google SecOps account is stored, see [SecOps service locations](https://cloud.google.com/terms/secops/data-residency).\n\nFor more information, see [Google SecOps pricing](https://cloud.google.com/security/products/security-operations#pricing).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
