You want to understand the deactivation timeline, data retention periods, and the necessary steps to restore services when your CloudSOC entitlement expires. This article outlines the exact lifecycle stages your tenant goes through upon expiration, including when services stop and when data is permanently deleted. Review the stages below to understand how an expired status impacts your CASB Audit, Securlet, and Gatelet configurations.
As of CloudSOC release 3.192, the lifecycle after your entitlement expires follows this timeline:
Expired (0th Day): A notification banner displays in the console.
Canceled (30th Day): Services stop. For example, active Securlets will stop data processing. New Audit logs are ignored, no API calls are made to SaaS applications, and the Gateway stops forwarding traffic. Only System Administrators can log in to access general platform configurations or download archives.
Terminated (90th Day): All tenant data is permanently deleted. If this is your last active entitlement for this CloudSOC tenant, the entire tenant is deleted.
For more information, please review this techdoc - CloudSOC Account Expiration Process