I agree, we have requirements with some customers to retain data beyond 90 days for compliance purposes, ideally the only data required is who what where when type data. Perhaps a model of 30 days of data with all logs then beyond 30 days just operational data e.g. what workflow, who ran it, what the workflow did such as task logs etc would be sufficient.

As an alternative possibly provide an option to allow export of all raw data into a 3rd party SIEM from which queries could be run within that external platform so that storage within the platform is retained at 30 days.

Or at least keep the minimum info on the executions past the 30 days

like this