METRICKEEPER
Get Early Access //
← Back to Archive
// Compliance2026-08-195 min read

PCI DSS Log Retention: What It Means for Your Cloudflare Logs

If you take card payments, PCI DSS sets a clear bar for logging, and it’s much longer than Cloudflare’s default retention windows.

This post explains the requirement, how Cloudflare data relates to it, and where the gaps usually are.

This is general information, not compliance advice. Your QSA decides what’s in scope for your assessment.

The requirement: 12 months, 3 immediately available

PCI DSS v4.0 Requirement 10.5.1 says audit log history must be retained for at least 12 months, with at least the most recent three months immediately available for analysis.

The reasoning, in plain terms: breaches are often discovered long after they start, and investigators need a window long enough to find the source.

Is Cloudflare in scope?

It depends on your architecture. Cloudflare is more likely to matter when:

  • It proxies your checkout or payment pages
  • It sits in front of APIs that handle cardholder data
  • Its WAF is one of your security controls for the cardholder data environment

If card data never touches anything behind Cloudflare, for example because you use a fully hosted payment page from your processor, your edge logs may be out of scope. That’s a conversation for your QSA.

Compare the requirement with Cloudflare’s defaults

Data Cloudflare default PCI DSS 10.5.1
Security Events (WAF) 24 hours (Free/Pro), 3 days (Business), 30 days (Enterprise) 12 months
Raw logs via Logpull 3–7 days, Enterprise only 12 months
Log Explorer Up to 2 years, contract customers ✓ can meet it
Logpush to your storage Whatever you keep, Enterprise only ✓ can meet it

The gap: If your Cloudflare logs are in scope, the defaults on every plan fall short. You need Logpush, Log Explorer, or another retention mechanism.

Audit logs vs. analytics

This distinction matters in an assessment.

  • Audit logs record individual events: who did what, when, from where, and with what result. PCI DSS Requirement 10 is about these.
  • Analytics are aggregates: requests per day, top IPs, blocked events by rule.

Aggregated analytics are very useful for investigations: they tell you when an attack started, which paths were targeted, and which IPs to look at. But they are generally not a substitute for per-event audit logs where those are required. If your QSA says Cloudflare request logs are in scope, plan for raw log retention.

Also remember the Cloudflare account audit log, the record of configuration changes like WAF rules, DNS, and SSL settings. Changes to security controls are exactly what assessors ask about.

A practical setup

  1. Ask your QSA whether Cloudflare traffic and configuration logs are in scope.
  2. If they are and you’re on Enterprise: Logpush to storage with a 12-month lifecycle rule, or Log Explorer. Keep the latest 3 months in a searchable tier. See the S3 + Athena cost breakdown.
  3. Either way: keep aggregated security analytics for at least 12 months. They’re cheap to keep and make investigations much faster.

Keep 12+ months of Cloudflare analytics

MetricKeeper archives your Cloudflare traffic and security analytics on a schedule with a read-only token, giving you a long-term timeline for investigations alongside whatever audit logging your assessment requires.

Get Early Access →

Sources