Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Total annual storage cost
$79,740
Hot/searchable tier cost
$56,700
Cold/archive tier cost
$23,040
Total volume under retention (GB)
109,500
Hot tier volume (GB)
13,500
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter daily log ingestion (gb).
- 2Enter hot/searchable retention (days).
- 3Enter cold/archive retention beyond hot (days).
- 4Enter hot storage cost ($/gb/month).
- 5Enter cold/archive storage cost ($/gb/month).
- 6Read your total annual storage cost on the right — it updates as you type.
- 7Hit Share to keep the scenario or send it to someone.
About this calculator
Compliance frameworks (PCI DSS wants 1 year with 3 months immediately available, HIPAA commonly drives 6 years, SOC 2 typically 1 year of audit-relevant logs, some state breach laws and cyber insurance requirements push further) force organizations to retain security log data far longer than operational needs alone would justify, and storage cost compounds because you're storing every prior period simultaneously during the retention window, not just the current period. This calculator projects total storage volume across daily ingestion rate and retention period, splits it between hot storage (fast, expensive, needed for active search) and cold/archive storage (cheap, slower to retrieve, fine for compliance-only data past a certain age), and produces an annual cost. Most SIEM cost overruns trace back to nobody modeling this compounding effect before committing to a retention policy, discovering only at renewal that 400GB/day for 400 days of hot retention is a very different number than 400GB/day for 30 days.
Worked example
Using the values the calculator loads with:
Inputs
- Daily log ingestion (GB): 150
- Hot/searchable retention (days): 90
- Cold/archive retention beyond hot (days): 640
- Hot storage cost ($/GB/month): 0.35
- Cold/archive storage cost ($/GB/month): 0.02
Results
- Total annual storage cost: $79,740
- Hot/searchable tier cost: $56,700
- Cold/archive tier cost: $23,040
- Total volume under retention (GB): 109,500
- Hot tier volume (GB): 13,500
What each field means
Inputs
- Daily log ingestion (GB)
- The daily log ingestion (gb) used in the calculation. Starts at 150 so you have a working example on load.
- Hot/searchable retention (days)
- The hot/searchable retention (days) used in the calculation. Starts at 90 so you have a working example on load. Accepted range: 1–3650.
- Cold/archive retention beyond hot (days)
- The cold/archive retention beyond hot (days) used in the calculation. Starts at 640 so you have a working example on load. Accepted range: 0–3650.
- Hot storage cost ($/GB/month)
- The hot storage cost ($/gb/month) used in the calculation. Starts at 0.35 so you have a working example on load.
- Cold/archive storage cost ($/GB/month)
- The cold/archive storage cost ($/gb/month) used in the calculation. Starts at 0.02 so you have a working example on load.
Results
- Total annual storage cost
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Hot/searchable tier cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Cold/archive tier cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Total volume under retention (GB)
- Returned as a whole number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Hot tier volume (GB)
- Returned as a whole number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Why does hot storage cost so much more than cold?
Hot/searchable tiers keep data indexed and immediately queryable for real-time detection and investigation, which requires more compute and faster disk (SSD/NVMe-backed) behind the scenes; cold/archive tiers just need durable, cheap storage since you rarely query it except for compliance audits or historical forensic investigation, and can tolerate minutes-to-hours retrieval time.
How long should hot retention actually be?
90 days is a common baseline that covers most detection use cases including slow-moving attacks, while satisfying PCI DSS's requirement for 3 months of immediately available log data; extend it if your SOC regularly needs to correlate incidents that unfold over longer windows, but every extra day compounds cost since you're now storing that day's volume at hot rates for the entire window.
Can I just delete logs after the hot retention period instead of archiving?
Only if no compliance framework or contractual obligation requires longer retention; PCI DSS, HIPAA, and many cyber insurance policies or customer security addendums specify minimum total retention (often 1-6+ years) regardless of whether the data needs to be searchable, which is exactly the gap cold/archive tiers are built to fill cheaply.
What's the fastest way to cut this cost without reducing retention?
Filter and reduce ingestion volume at the source before it hits your SIEM or log platform: dropping verbose debug-level logs, deduplicating repetitive events, and sending only security-relevant fields instead of full raw payloads routinely cuts ingestion volume 30-50% without losing detection value.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
SIEM Log Ingestion Cost Calculator
Estimate monthly SIEM cost from log volume, sources, and retention period.
SOC 2 Audit Cost Calculator
Estimate first-year SOC 2 Type II cost including prep, auditor fees, and tooling.
EDR Licensing Cost Per Endpoint Calculator
Budget endpoint detection and response licensing across your full fleet.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Security Data Retention Storage Cost Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/data-retention-storage-cost
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/data-retention-storage-cost" target="_blank" rel="noopener">Security Data Retention Storage Cost Calculator — RevenueLab</a> (2026).</p>
Source: [Security Data Retention Storage Cost Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/data-retention-storage-cost) (2026).