Data Retention
Overview
Data retention controls how long ET Ducky keeps your cloud-stored data — ETW events, event batches, health metrics, health records, correlation analyses, detected patterns, and live session data. All organizations start with 14-day retention at no cost. You can extend retention with the per-agent add-on.
Retention Tiers
| Tier | Retention | Price | Best For |
|---|---|---|---|
| Free (Default) | 14 days | $0 | Active troubleshooting |
| Extended | 90 days | $0.50/agent/month | Monthly trend analysis, short-term compliance |
| Annual | 365 days | $1.50/agent/month | Annual compliance, performance baselining |
| Maximum | 730 days | $2.50/agent/month | Audit requirements, long-term capacity planning |
Annual billing: Save 15% on retention costs, same as all other subscriptions.
How Billing Works
Per-Agent Pricing
Retention is billed per registered managed agent in your organization. Desktop agents that sync to the cloud are included. The quantity on your Stripe subscription updates automatically when agents are added or removed — no manual adjustments needed.
Example Costs
| Agents | Extended (90d) | Annual (365d) | Maximum (730d) |
|---|---|---|---|
| 10 | $5/mo | $15/mo | $25/mo |
| 50 | $25/mo | $75/mo | $125/mo |
| 200 | $100/mo | $300/mo | $500/mo |
What Gets Retained
All data types share the same retention window set by your tier:
- ETW Events & Event Batches — Raw diagnostic events from agents
- Agent Health Metrics & Records — CPU, memory, disk, and performance data
- Correlation Analyses & Detected Patterns — Multi-agent analysis results
- Live Sessions & Session Events — Interactive diagnostic session data
Data older than your retention window is permanently purged during the daily maintenance window (3:00 AM UTC).
Agent Network Identity & Connection Logs
Handled separately from the telemetry tiers above: each agent's registration source IP, most-recent (last-seen) connection IP, and device identifiers (machine/MAC/disk identifiers, timezone, locale) are stored on the agent record and are removed when the agent is deleted. Authentication and agent-connection logs that include source IP, and logs of connections that presented an invalid or revoked credential, are retained for security and abuse-prevention purposes for 12 months. These are not subject to the per-tier purge window.
Security & Fraud Signals
Held separately and used only for security, fraud prevention, and abuse detection: limited payment metadata (a non-reversible card fingerprint and billing country — never full card details), account registration context (sign-up IP and device characteristics), and threat indicators observed in evaluated commands. Payment metadata is kept for the life of the account and a limited period afterward for accounting and legal-claim purposes; the rest are retained for security purposes and are not subject to the per-tier purge window.
Security / Legal Hold
Data associated with a security incident or a banned account may be placed on a legal/security hold. While held, that data is preserved as evidence — exempt from the purge windows above and not deleted on ban — until the hold is released by an administrator.
Managing Retention
Purchase or Upgrade
From the Dashboard, use the Data Retention card or the Manage Data Retention button in Quick Actions. Select your desired tier and complete checkout via Stripe. Upgrades take effect immediately.
Downgrade or Cancel
Use Manage Billing / Cancel in the retention modal to open your Stripe billing portal. Downgrades and cancellations take effect at the end of the current billing period. After cancellation, retention reverts to the free 14-day default.
Custom Overrides
Enterprise customers can request per-data-type retention overrides (e.g., 365 days for events but 90 days for session data). Contact support to configure custom retention policies.
Self-Hosted Deployments
Data retention add-ons apply only to cloud-hosted (etducky.com) deployments. Self-hosted instances manage their own database storage and retention policies — there is no automatic purge service or per-agent billing for self-hosted data.