OXU Guard Data Retention and Deletion Policy

1. Data processed by OXU Guard

OXU Guard processes two main categories of data:

Raw event data

Raw event data is the original information sent to OXU Guard by a connected data source.

Depending on the source, this may include:

• JSON event payloads
• Activity or audit logs
• Action types and outcomes
• Field names and values
• Usernames, email addresses, or user identifiers
• IP addresses
• Device or resource identifiers
• Timestamps
• Other context included in the source event

The exact data sent depends on the connected source and its integration configuration.

Security records and configuration data

OXU Guard creates and maintains records as part of its detection, monitoring, and investigation workflows.

These records may include:

These records may contain a limited subset of information derived from raw events where required to preserve the meaning of a detection or investigation record.

2. Retention summary

OXU Guard applies different retention periods based on the purpose of the data.

Raw events are automatically deleted when they reach the end of their retention period.

Security records are stored independently from raw events and remain available until the related data source is deleted.

3. Raw event retention

OXU Guard retains raw event data for three months from the time the event is received.

When a raw event reaches the end of this period:

• The original event payload is deleted.
• The original event field values can no longer be retrieved.
• The event cannot be restored through OXU Guard.
• Existing security records created from the event may remain available.

Raw event retention is based on the event’s original received time. Disconnecting and reconnecting a source does not restart or extend its retention period.

4. Security record retention

Security records are retained separately from the raw events that contributed to them.

This allows OXU Guard to preserve a continuous operational history of:

• What the system detected
• Which Actor and activity were associated with the detection
• How the activity differed from typical behavior
• What investigation actions were taken
• How an alert or insight was resolved
• Which detection and monitoring configurations were applied
• Who changed a configuration or lifecycle status

After the associated raw events expire, a security record may continue to show the limited detection context required to understand the record, such as:

• Detection name and description
• Actor
• Anomaly Score
• Observed and typical behavior
• Alert or insight status
• Investigation notes
• Resolution information
• Relevant timestamps

The original raw event payload is no longer available after its retention period expires.

5. Source types

OXU application sources

An OXU application source uses a built-in integration managed by OXU.

The application sends security-relevant activity through a defined and validated data contract. The application’s own disclosure describes:

• Which activities are shared
• Which fields may be included
• Which protected content is excluded
• Who can authorize data sharing

Custom or external sources

A custom or external source is configured by your organization to send events to an OXU Guard ingestion endpoint.

For these sources, your organization controls the submitted payload and is responsible for:

• Having the authority to send the data to OXU Guard
• Providing appropriate notice to affected users where required
• Excluding unnecessary confidential or sensitive information
• Maintaining any additional copies required for legal, regulatory, or operational purposes
• Securing the integration credentials used to submit events

OXU Guard processes the fields contained in the events submitted by the source. Organizations should send only the information required for security monitoring.

6. Disabling or disconnecting a source

Disabling monitoring or disconnecting a data source stops OXU Guard from processing new events from that source.

This action does not automatically delete previously received data.

While a source is disabled or disconnected:

• No new events are processed.
• Existing raw events remain subject to the standard three-month retention period.
• Existing alerts, insights, rules, schema definitions, and investigation records remain available.
• Existing retention periods continue to run.
• Reconnecting the source resumes event processing but does not reset previous retention periods.

If all source-related data must be removed, an authorized user must delete the data source.

7. Deleting a data source

OXU Guard provides an option for authorized users to delete a data source.

Deleting a data source permanently deletes all data associated with that source from OXU Guard, including:

• Raw event data
• Alerts
• Behavior Insights
• Investigation records
• Source-specific rules
• Schema definitions and mappings
• Detection Intelligence baselines
• Detection Intelligence settings
• Notification recipients and settings
• Source configuration and tags
• Source-related activity and history records

Deletion cannot be undone, and deleted data cannot be recovered through OXU Guard.

Before completing the action, OXU Guard requires the user to confirm that they understand its impact.

Deleting a source does not delete data retained independently by the original application, external source, SIEM, data lake, or other system outside OXU Guard.

8. Effect of raw event deletion

Deleting an individual raw event through the standard retention process does not automatically delete security records previously created from that event.

For example, an Alert or Behavior Insight may continue to display:

• Its detection summary
• Actor
• Anomaly Score
• Observed and typical behavior
• Lifecycle status
• Investigation and resolution history

However, the original event payload and its complete field set are no longer available.

To remove both raw events and their associated security records, the related data source must be deleted.

9. Investigating historical activity

For activity within the three-month raw event retention period, OXU Guard may provide access to:

• The original event data
• Security records created from that data

For older activity, only retained security records may remain available.

Organizations that require original event data for longer periods should maintain a separate copy outside OXU Guard.

10. Long-term data retention

OXU Guard is a security monitoring service and is not intended to serve as a long-term archive for raw logs or event payloads.

Organizations requiring longer retention for legal, regulatory, forensic, or internal policy purposes should retain the original events in an appropriate external system, such as:

• A SIEM
• A log management platform
• A data lake
• An archival or cold-storage system

Your organization is responsible for determining whether additional retention is required.

11. Data use and external delivery

OXU Guard uses connected source data to provide security monitoring capabilities, including:

• Detecting activity that matches configured rules
• Generating security alerts
• Identifying unusual behavior
• Building behavioral baselines
• Supporting investigation and resolution workflows
• Delivering configured notifications and response actions

OXU Guard does not sell security data or use it for advertising.

Data may be delivered outside OXU Guard only when authorized by your organization, such as through:

• Email notifications
• A webhook or response action configured by an authorized user
• Another organization-approved integration

Your organization is responsible for the endpoints, recipients, and external systems it configures to receive this information.

12. Retention limitations

The current version of OXU Guard uses a standard three-month retention period for raw event data.

This period:

• Applies to all connected sources unless otherwise stated.
• Cannot currently be changed through product settings.
• Is independent of source volume.
• Continues while a source is disabled or disconnected.
• Does not restart when a source reconnects.

Security records follow the lifecycle of their related data source and are deleted when the source is deleted.

13. Frequently asked questions

Can I change the raw event retention period?

No. OXU Guard currently applies a standard three-month retention period to raw event data.

Does an alert disappear when its raw event expires?

No. Alerts and other security records are stored independently and may remain available while the related data source exists.

Can I retrieve raw event data after three months?

No. Once raw event data reaches the end of its retention period, it cannot be recovered through OXU Guard.

What happens when I disconnect a source?

OXU Guard stops processing new events. Existing data remains subject to its normal retention policy.

What happens when I delete a source?

All data associated with that source is permanently deleted from OXU Guard and cannot be recovered.

Can I retain the same events somewhere else?

Yes. Your organization may retain or forward its own events to another approved storage or security system.

Does this policy apply to external sources?

Yes. The same retention and deletion rules apply unless a different policy is explicitly stated. Your organization remains responsible for the content submitted through custom or external integrations.

Does deleting a source delete data from the original application?

No. Source deletion removes the associated data from OXU Guard only. It does not delete records held by the original application or another external system.

14. Contact

For questions about OXU Guard data retention, deletion, or connected data sources, contact:

OXU Support: [email protected]