Application logs are retained for a minimum of 12 months and are tamper-evident, supporting incident detection and analysis.