Every file Openclaw writes to disk is a retention decision you made by default. The agent stores conversation logs, daily notes, MEMORY.md entries, and workspace files on your local machine with no expiration date unless you configure one. For teams operating under GDPR, HIPAA, or SOX, that default is a compliance gap waiting to surface during an audit.
For teams in regulated industries, the first question is always the same: “What data does the agent keep, and for how long?” This guide answers that question with specific configuration blocks, working purge scripts, and retention schedules mapped to the three compliance frameworks most commonly encountered.
How Openclaw Stores Data
Openclaw’s memory system writes everything to plain files on your filesystem. There is no hidden database, no cloud sync (unless you configure one), and no opaque state. That transparency is the foundation of any retention policy.
Three categories of data accumulate over time:
- Evergreen files such as
MEMORY.md,SOUL.md, andUSER.mdpersist indefinitely. These contain durable facts, preferences, and identity configuration. The official docs mark these as “never decayed” by the temporal scoring system. - Daily notes in
memory/YYYY-MM-DD.mdcapture session-level observations and task context. These accumulate one file per active day. - Session transcripts stored as JSONL files record full conversation histories. These are the largest data category by volume and the most sensitive from a compliance perspective.
The bootstrap loader reads up to 20,000 characters per file and 150,000 characters in aggregate at session start. Files beyond those limits are available through memory_search but do not load automatically. This matters for retention because old files that exceed the bootstrap cap still exist on disk, consuming storage and creating compliance exposure, even though the agent no longer reads them at startup.
For a deeper walkthrough of memory architecture, see our Openclaw memory configuration guide.
Audit Trail vs. Ephemeral Data
Before configuring retention periods, classify your data into two categories. This distinction drives every policy decision that follows.
Audit trail data must be retained for a defined period and must be retrievable on demand. This includes decision logs in MEMORY.md, compliance-relevant session transcripts, and any file the agent creates that records a business action (sending an email, updating a CRM record, executing a financial transaction).
Ephemeral data serves a temporary purpose and carries no regulatory retention obligation. This includes casual conversation logs, temporary task context in daily notes, draft documents, and working files that fed into a final deliverable.
The most common mistake: teams treat all Openclaw data as ephemeral and purge aggressively, then cannot produce records when a compliance officer or auditor requests them. The second most common mistake is the opposite: retaining everything indefinitely, which violates GDPR’s data minimization principle and increases breach exposure.
A retention policy needs both a floor (minimum retention for audit trail data) and a ceiling (maximum retention for ephemeral data).
Configuring Session Retention
Session transcripts are the primary target for retention policies. Openclaw exposes retentionDays in the memory configuration to control how long session JSONL files remain indexed and searchable.
Add this to your settings.json:
{
"agents": {
"defaults": {
"memory": {
"sync": {
"sessions": {
"retentionDays": 90,
"deltaBytes": 100000,
"deltaMessages": 50
}
}
}
}
}
}
This keeps session transcripts indexed for 90 days. After that window, the search index drops them. However, the raw JSONL files remain on disk until you delete them. The retentionDays setting controls indexing, not deletion. You need a separate cleanup mechanism for the files themselves.
Temporal Decay for Memory Scoring
Openclaw’s temporalDecay setting reduces the relevance score of older memory files in search results. The default half-life is 30 days, meaning a 30-day-old file scores at 50% of its original relevance, a 60-day-old file at 25%, and so on.
{
"agents": {
"defaults": {
"memory": {
"temporalDecay": {
"halfLifeDays": 30,
"evergreenPaths": ["MEMORY.md", "SOUL.md", "USER.md"]
}
}
}
}
}
Files listed in evergreenPaths are exempt from decay. They always return at full relevance regardless of age. For compliance purposes, add any file that serves as an audit trail to this list so it remains discoverable.
Compliance-Driven Retention Schedules
Each regulatory framework imposes different retention requirements. Below are configurations mapped to the three frameworks most frequently encountered in regulated Openclaw deployments.
GDPR: 30-Day Ephemeral, Indefinite Audit Trail
GDPR’s data minimization principle (Article 5(1)(e)) requires that personal data be kept “no longer than is necessary for the purposes for which the personal data are processed.” For most Openclaw use cases, 30 days covers the operational window for conversation data.
Separately, GDPR Article 17 establishes the right to erasure. You must be able to locate and delete all data associated with a specific person on request. Openclaw’s file-based storage makes this grep-and-delete, but you need a documented process.
{
"agents": {
"defaults": {
"memory": {
"temporalDecay": {
"halfLifeDays": 14
},
"sync": {
"sessions": {
"retentionDays": 30
}
}
}
}
}
}
Pair this with the automated purge script in the next section to enforce file deletion. For audit trail files, maintain a separate compliance/ directory with its own retention policy (typically the duration of the business relationship plus one year).
For full GDPR deployment guidance including EU infrastructure selection, see our Openclaw GDPR and data privacy guide.
HIPAA: 6-Year Retention Floor
HIPAA’s retention rule (45 CFR 164.530(j)) requires covered entities to retain compliance documentation for six years from the date of creation or the date it was last in effect. If your Openclaw agent processes protected health information (PHI), session transcripts and decision logs fall under this requirement.
{
"agents": {
"defaults": {
"memory": {
"temporalDecay": {
"halfLifeDays": 365,
"evergreenPaths": ["MEMORY.md", "SOUL.md", "USER.md", "compliance/*"]
},
"sync": {
"sessions": {
"retentionDays": 2190
}
}
}
}
}
}
The 2,190-day retention (6 years) keeps session transcripts indexed for the full compliance window. Set the temporal decay half-life high (365 days) so that compliance-relevant memories remain easily discoverable through search. Consider encrypting the memory directory with AES-256 and rotating keys every 90 days, consistent with HIPAA’s security rule requirements.
SOX: 7-Year Retention Floor
SOX Section 802 and SEC Rule 17a-4 require retention of records relevant to financial audits for seven years. If your Openclaw agent handles financial reporting, invoice processing, or audit-related tasks, its session transcripts and decision logs are audit records.
{
"agents": {
"defaults": {
"memory": {
"temporalDecay": {
"halfLifeDays": 365,
"evergreenPaths": ["MEMORY.md", "SOUL.md", "USER.md", "compliance/*"]
},
"sync": {
"sessions": {
"retentionDays": 2555
}
}
}
}
}
}
The 2,555-day retention (7 years) covers the SOX window. Pair this with immutable backup storage. Git-based versioning with signed commits allows you to prove records have not been altered, a requirement auditors consistently ask about.
For backup configuration, see our Openclaw backup and restore guide.
Automated Purging Scripts
The retentionDays setting handles index expiration, but the files stay on disk. This script handles the actual deletion. Save it as purge-openclaw-data.sh in your Openclaw workspace:
#!/bin/bash
# Openclaw data retention enforcement
# Run via cron: 0 3 * * * /path/to/purge-openclaw-data.sh
WORKSPACE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}"
EPHEMERAL_DAYS=30 # Adjust per compliance framework
LOG_FILE="$WORKSPACE/compliance/purge-log.txt"
mkdir -p "$WORKSPACE/compliance"
echo "--- Purge run: $(date -u +%Y-%m-%dT%H:%M:%SZ) ---" >> "$LOG_FILE"
# Purge daily notes older than retention window
find "$WORKSPACE/memory" -name "????-??-??.md" -mtime +$EPHEMERAL_DAYS -print \
| while read f; do
echo "DELETED: $f" >> "$LOG_FILE"
rm "$f"
done
# Purge session transcripts older than retention window
find "$WORKSPACE/sessions" -name "*.jsonl" -mtime +$EPHEMERAL_DAYS -print \
| while read f; do
echo "DELETED: $f" >> "$LOG_FILE"
rm "$f"
done
# Never touch evergreen files or compliance directory
echo "Purge complete. Ephemeral files older than ${EPHEMERAL_DAYS}d removed." >> "$LOG_FILE"
Schedule it with cron:
crontab -e
# Add this line (runs daily at 3 AM):
0 3 * * * /path/to/purge-openclaw-data.sh
The script logs every deletion to compliance/purge-log.txt, creating an audit trail of the purging process itself. Adjust EPHEMERAL_DAYS to match your compliance framework: 30 for GDPR ephemeral data, 2190 for HIPAA, 2555 for SOX.
Per-Topic Retention with File Architecture
Openclaw’s file-based memory system supports per-topic retention through directory conventions. Instead of applying a single retention period to all data, organize files by sensitivity:
workspace/
MEMORY.md # Evergreen: no expiration
SOUL.md # Evergreen: no expiration
memory/
2026-04-01.md # Ephemeral: 30-day retention
2026-03-15.md # Ephemeral: 30-day retention
compliance/
audit-decisions.md # Audit trail: framework-specific retention
data-processing-log.md # Audit trail: framework-specific retention
sessions/
session-2026-04-01.jsonl # Governed by retentionDays setting
Add the compliance/ directory to your evergreenPaths so those files are never decayed in search. Modify the purge script to skip that directory entirely (already handled in the script above). This gives you two-tier retention: aggressive cleanup for ephemeral data and long-term preservation for audit records.
For teams managing multiple agents, the Openclaw audit logging guide covers centralized log collection across agent instances.
Handling Data Subject Access Requests
Under GDPR Article 15, individuals can request a copy of all personal data you hold about them. Under Article 17, they can request deletion. With Openclaw’s file-based storage, this is a filesystem operation:
Locate all data for a person:
grep -rl "Jane Doe" "$WORKSPACE/memory" "$WORKSPACE/sessions" "$WORKSPACE/compliance"
Export for a DSAR response:
mkdir -p /tmp/dsar-export
grep -rl "Jane Doe" "$WORKSPACE" | xargs -I{} cp {} /tmp/dsar-export/
Delete for a right-to-erasure request:
grep -rl "Jane Doe" "$WORKSPACE/memory" "$WORKSPACE/sessions" \
| while read f; do
echo "ERASED: $f (DSAR request)" >> "$WORKSPACE/compliance/purge-log.txt"
rm "$f"
done
Do not delete files in the compliance/ directory as part of a DSAR without legal review. Audit trail retention obligations may override the right to erasure under GDPR Article 17(3)(e), which provides an exception for legal claims.
Frequently Asked Questions
How long does Openclaw store conversation logs by default?
Indefinitely. Openclaw writes session transcripts as JSONL files to disk and never deletes them automatically. The retentionDays setting controls search index duration, not file lifecycle. You need the purge script or manual deletion to enforce actual data removal.
Can I set different retention periods for different data types?
Yes, through file architecture conventions. Place audit trail data in a compliance/ directory marked as evergreen, and let the purge script clean ephemeral data in memory/ and sessions/ on a shorter cycle. The temporal decay evergreenPaths setting ensures compliance files stay fully discoverable.
Is Openclaw GDPR compliant out of the box?
No. Openclaw stores data locally, which avoids third-party data transfer issues, but GDPR compliance requires active configuration: retention limits, a documented deletion process, DSAR handling procedures, and a Data Processing Agreement with your LLM API provider. The local-first architecture is a strong foundation, but you must build the policy layer on top.
Does Openclaw encrypt stored memory data?
Not by default. Memory files are plain Markdown and JSONL on your filesystem. For HIPAA deployments, full-disk encryption (LUKS on Linux, FileVault on macOS) plus application-level encryption for the memory directory is recommended. The encryption configuration shown in the HIPAA section is a recommended pattern, not a built-in feature.
What is the difference between temporal decay and data deletion?
Temporal decay reduces a file’s relevance score in search results over time but does not delete the file. A file with a fully decayed score still exists on disk and can be found through direct file access. Data deletion (via the purge script) removes the file permanently. You need both: decay for relevance management and deletion for compliance.
Can I configure Openclaw for HIPAA compliance?
Yes, with significant configuration. Set retentionDays to 2,190 (6 years), encrypt the workspace directory, implement access controls, and maintain audit logs of all data access and deletion. See the HIPAA configuration block above for the memory settings. You will also need a Business Associate Agreement with your LLM API provider.
How do I verify what data my agent currently stores?
Run ls -la on your workspace directory to see all files. Use du -sh on the memory/ and sessions/ directories to check total data volume. For a more targeted check, find "$WORKSPACE" -mtime -30 -type f | wc -l counts files modified in the last 30 days.
What happens to data during compaction?
Compaction is a lossy summarization of the conversation context window, not a file operation. It rewrites the in-memory conversation history to free up tokens but does not delete files from disk. Session transcripts remain intact after compaction. The memory flush feature (enabled by default) saves important context to files before compaction occurs.
Key Takeaways
- Openclaw retains all data indefinitely by default. Every deployment needs an explicit retention policy.
- Classify data as audit trail or ephemeral before choosing retention periods. The distinction drives every configuration decision.
- Use
retentionDaysfor search index expiration and the purge script for actual file deletion. They solve different problems. - Map retention periods to your compliance framework: 30 days for GDPR ephemeral data, 6 years for HIPAA, 7 years for SOX.
- File architecture (separate
compliance/directory with evergreen status) is the simplest way to implement per-topic retention without custom tooling.
SFAI Labs
