Key Takeaways
- Log retention on OSS GitHub SMS stacks must separate OTP secrets from ops metrics.
- Default to short retention for message bodies; longer for delivery status ids.
- Link the open-source hub; do not rewrite the overview.
- GDPR-minded deletion is your policy — the radio does not invent it.
- SaaS Free is 1 device / 300 SMS lifetime if comparing; airtime always yours.
What to keep
Log retention policy for open-source GitHub Android SMS gateways is a privacy and support tradeoff. Keep enough to debug DLR; delete enough that OTP bodies are not immortal in Elasticsearch. Hub: open source.
“If support can paste yesterday’s OTP from logs, your retention policy already failed.”
Retention pulse
7d bodies
30d status
90d audit
Data classes
| Class | Examples | Retention lean |
|---|---|---|
| Secrets | OTP plaintext, API keys | Do not store / redact ASAP |
| Message ops | ids, status, timestamps | Weeks–months |
| Audit | admin actions, key rotate | Longer, access-controlled |
| Debug dumps | full PDU traces | Hours–days, gated |
OTP bodies
Prefer hashed codes at rest in your app DB. Gateway logs should not be a second OTP store. OTP use case.
OSS ops
Document who can query logs. Rotate access with staff changes. SaaS alternative: product overview.
Cost
Storage is cheap; breach cost is not. Pricing comparison: devices + volume.
Next steps
Write the policy; enforce with TTLs; canary a deletion job.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK





