Retention depends on compliance requirements and forensic needs. Hydrolix customer stories show managed offerings providing 15+ months of hot retention by default, allowing for year-over-year performance comparisons and long-term security trend analysis.