Description
Ensure workspace audit logs are exported at least every 90 days and stored for at least one year in a secure location, such as a SIEM or protected storage. Render keeps at least the last 90 days of audit log events, and each export can cover at most 90 days.
Rationale
Audit logs record logins, member changes, secret views, shell access, and changes to protected environments. Investigations often need history older than 90 days. Exporting regularly and keeping the files for a year makes sure this evidence is not lost when Render's retention period ends.
Impact
Audit history is kept for at least one year
Supports investigations and compliance audits
Exports must be scheduled and stored securely
Default Value
Render retains at least the last 90 days of audit log events. Audit logs require a Pro plan or higher, and nothing is exported automatically.
Pre-Requisites
Workspace Admin role
Pro plan or higher (Scale or Enterprise for organization audit logs)
A secure storage location
Remediation
Test Plan
Check your storage location for audit log exports covering the last 12 months without gaps.
Confirm the most recent export is less than 90 days old.
If exports are missing or older than 90 days, follow the implementation steps.
Implementation Steps
Sign in to the Render Dashboard at https://dashboard.render.com.
Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
Scroll down to the Compliance section.
Under Audit Logs, select a start and end date (at most 90 days), then click Export as CSV.
Store the CSV in your secure storage location and keep it for at least one year.
To automate this, call the Render API's List workspace audit logs endpoint on a schedule (for example monthly) and send the results to your SIEM.
Backout Plan
Stop the scheduled export job if needed. Exported files can be deleted from storage according to your retention policy.
Reference