How we guarantee collection is off when SIEM is off

Not a promise in a policy — three independent technical controls.

1. 1Agent-side: log collection defaults to off and only runs while the server's response to each agent report says your SIEM subscription is active. Cancel or pause, and every agent stops collecting within one check-in — they don't read another log line.
2. 2Server-side: the ingestion API independently re-checks your subscription on every single request and refuses data (HTTP 403) for any workspace without active SIEM — so even a tampered or out-of-date agent physically cannot land data. Agents treat that refusal as an immediate stop signal.
3. 3Storage-side: after cancellation your stored logs are kept 30 days (in case you return), then permanently deleted — the encrypted storage, the search index partitions, alerts, offenses, and source records, all of it.
4. 4Every workspace's logs are isolated under a per-workspace encrypted prefix (AWS KMS) and all searches are workspace-scoped at the query layer.
5. 5Enabling and disabling are never silent: agents log the change locally and admins can see collection state on the Collectors page at any time.

Tip: This page doubles as the answer to your auditor's or customer's "what happens to our logs if we leave?" question.