Not every signal deserves the same retention price. Three tiers, automatic movement between them, and a real number attached to each.

Retention had been one setting per signal type in Helix: keep traces for 30 days, full stop, at full query speed the entire time. That was simple and also wrong for how data actually gets used — almost everyone queries the last 3 days constantly and the remaining 27 almost never, except during a rare compliance or long-tail investigation.

Three tiers, one query interface

Data now moves automatically through hot (fast SSD-backed, full query speed), warm (compressed, slightly higher query latency, days 4-30 by default), and cold (object storage, higher latency, retrievable but not instant) — and critically, HelixQL queries transparently across all three without you specifying which tier a query needs to hit:

from traces
| where timestamp > ago(45d)
| where route == "/checkout" and status == "error"
| summarize count() by bin(1d)
// transparently spans hot, warm, and cold tiers in one query

What each tier actually costs

Cold storage runs roughly 1/12th the cost per gigabyte of hot. For a typical customer whose query volume drops off a cliff after day 3, moving days 31-180 to cold tier instead of keeping everything hot for 30 days and deleting cut their blended storage cost by 52% while keeping the same 180-day compliance retention window they needed.

The tradeoff we're upfront about

Cold-tier queries take longer — typically 8-15 seconds instead of sub-second — because we're pulling from object storage rather than SSD. For the rare investigation that needs cold data, that latency is a fine trade for the storage savings on the 99% of queries that never touch it. We show which tier a query hit in the response so nobody's surprised by the timing.

Tuning the tier boundaries per workspace

The default 3-day hot and 30-day warm boundaries came from aggregate query-pattern data across our customer base, but no two workspaces query the same way — a compliance-heavy customer might need 14 days hot to satisfy an internal audit SLA, while a high-traffic consumer app might only ever query the last few hours. Both boundaries are configurable per signal, and we surface a recommendation based on a workspace's own 90-day query history rather than shipping one default and hoping it fits.

  • Automatic hot/warm/cold tiering with one transparent query interface
  • Cold storage at roughly 1/12th the per-gigabyte cost of hot
  • Typical blended storage savings around 52% at unchanged retention windows
  • Query response indicates which tier was hit, so latency is never a surprise