How long should an office keep AI chat records? Set it by kind of record, not with one number for everything.
Short answer. There is no single period. Sort records into four kinds and give each its own rule. Working chats can be short-lived. Outputs used in client work belong in the client file under that file’s rules. Audit and model-call logs are kept for investigations. Anything under a legal hold is kept until it is released. Two Indian rules shape the logs. CERT-In’s directions ask covered organisations to keep ICT system logs for a rolling 180 days. The DPDP Rules, which start about eighteen months after 13 November 2025, ask for certain logs and personal data to be kept for at least one year. The DPDP Act also requires erasing personal data once its purpose is served, unless a law requires keeping it.
01
Four kinds of record
Kind
Examples
Suggested approach
Why
Working chats
Brainstorms, drafts, questions
Short retention, or temporary chats for sensitive questions
Less stored means less to breach or disclose
Outputs used in work
A letter, minutes or a summary that went to a client
Save the final version in the client file and keep it under that file’s schedule
The record of the work is the output, not the chat
Audit and model-call logs
Who asked which model, when, local or cloud
Keep for your chosen investigation window and protect from edits
Needed to investigate incidents and show who did what
Held for a dispute or inquiry
Anything relevant to a claim or investigation
Suspend deletion until counsel releases it
Destroying material that may be needed in a dispute is a risk of its own
02
What the rules say (general information, not legal advice)
CERT-In, directions of 28 April 2022, direction (iv): covered entities must enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days, within Indian jurisdiction. CERT-In’s FAQ adds that logs may be stored outside India if they can be produced to CERT-In in reasonable time.
DPDP Act, section 8(7): erase personal data when consent is withdrawn or when it is reasonable to assume the purpose is no longer served, unless retention is necessary for compliance with a law.
DPDP Rules, rule 6(1)(e): retain logs and personal data for one year to detect and investigate unauthorised access, unless another law requires otherwise. Rule 8(3): retain personal data, traffic data and other logs of processing for a minimum of one year for specified purposes, then erase them. These rules start eighteen months after 13 November 2025, so they are not in force as of October 2026.
NIST SP 800-123 lists what sets a log retention period: legal and regulatory requirements, organisational requirements, the size of the logs, the value of the data and services, and the threat level.
OWASP’s logging guidance says logs and their backups must not be destroyed before the required retention period ends and must not be kept beyond it.
03
Do chat logs count?
The CERT-In direction speaks of logs of ICT systems. Its FAQ gives firewall, server, application, SSH and VPN logs as examples, and says both successful and unsuccessful events should be recorded. Neither document says whether the text of a chat is a log.
A careful office treats metadata logs (who, when, which model) and chat content separately: keep the metadata for the longer investigation period, and keep content only as long as the work needs it. NIST SP 800-92 separates log retention, archiving on a regular basis, from log preservation, keeping logs that would normally be discarded because they matter to an incident or investigation. It also expects destruction when the period ends, including copies in backups.
04
Setting the schedule
Write the four-row table into the AI policy with a number of days for each kind.
Turn on only the logging you will use. As of October 2026, Open WebUI’s audit logging is off by default, and its guidance is to keep it to metadata unless logging chat content has been approved.
Automate deletion. A rule nobody runs is not a rule.
Tell staff what is kept and for how long.
Review once a year, and whenever the law or your regulator changes.
05
What ANVE says
ANVE logs every model call with the user, the app, the model and whether it ran locally or in the cloud. The retention period for those logs, whether chat content is stored, whether retention can be configured and how records can be exported are not stated here. ANVEAI confirms them in writing before a paid pilot.
06
Questions people ask
Should we keep chats forever?
No. Keeping personal data longer than its purpose needs conflicts with the erasure duty in the DPDP Act and enlarges what a breach would expose.
Can staff delete their own chats?
That is a policy choice. Allowing it supports data minimisation but can destroy records you need. Many offices let staff delete working chats while the logs stay.
What if a client matter is in dispute?
Suspend deletion for material that may be relevant, and ask your counsel when it can resume.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
