Sophos Central Data Storage Subscriptions

Description

Sophos Central Data Storage Subscriptions

The Sophos Central Data Storage subscription is an add-on license that stretches how long your security data sticks around inside Sophos Central. By default, the Sophos Data Lake keeps XDR and MDR data for 90 days and EDR data for only 30 days. Once that window closes, older records age out and disappear for good. This subscription pushes that retention window out to a full 365 days, which matters a lot when an investigation, an audit, or an insurance claim needs to look back further than three months.

Netmate IT Services is a Sophos solutions partner working out of Bur Dubai, UAE, with a team of 20+ certified cybersecurity engineers and 20+ presales consultants who help businesses pick the right license mix for their environment. The company’s main focus is the UAE market, and it also supports clients across the GCC, Kenya, and Nepal, handling everything from license sizing to activation and ongoing renewal.

Key Features of Sophos Central Data Storage Subscriptions

Extends retention from 90 days to a full year

Without this subscription, a security incident that gets discovered four months after it happened is basically invisible. The original telemetry has already aged out of the Data Lake. This add-on keeps that data alive for 365 days instead, so a hospital in Abu Dhabi or a bank in Dubai investigating a slow-moving breach still has the evidence it needs, months after the fact.

Covers both Sophos and third-party telemetry

The extended retention doesn’t just apply to Sophos’s own endpoint and server data. Third-party telemetry feeding into the Data Lake gets the same year-long window too. That means a security team pulling data from multiple sources into one investigation isn’t stuck with mismatched retention windows where one feed disappears while another survives.

Works with Central Firewall Reporting

Customers who also hold a Central Firewall Reporting license can pull up to a year of firewall data out of the same Data Lake, provided their firewall license supports it. This lines up nicely for a company already running Sophos Firewall Xstream Protection, since firewall logs and endpoint telemetry can be reviewed together over the same stretched timeline instead of two separate retention clocks.

Priced and licensed by user and server tier

The subscription is sold in volume tiers based on total user and server count, from small businesses running under 100 licenses up to large enterprises with tens of thousands. Terms are available as new purchases or renewals, in a range of contract lengths. This lets a growing company in Sharjah or Nairobi scale the license up as headcount increases, rather than locking into one fixed package that doesn’t fit later.

Doesn’t change the daily upload limits

It’s worth being clear on what this add-on does and doesn’t touch. Devices still upload data under the same daily caps, up to 2 GB per device per day, with separate pooled limits for endpoints and servers based on license count. What changes is how long that collected data stays queryable, not how much gets collected each day. A business expecting unlimited daily logging from this subscription alone will be disappointed; it solves a retention problem, not a volume ceiling.

Keeps data ready for queries and investigations

Only customers with access rights can run queries against the Data Lake directly, using tools like Live Discover to search historic telemetry. With the extended retention active, a security analyst can go back and trace a suspicious login or a file execution from eight months ago just as easily as one from last week, instead of hitting a dead end at the 90-day mark.

Supported Products/Platforms

Common Use Cases

Teams add this subscription when a short retention window has already burned them once, or when they know their industry expects a longer paper trail than the default allows: an insurance company in Dubai reconstructing a claim tied to a cyber incident from five months back, a healthcare group in Abu Dhabi that needs to show auditors a full year of security logs during a compliance review, a school network in Kathmandu troubleshooting a pattern of suspicious logins that only becomes obvious once someone compares data across several months, or a logistics company spanning Sharjah and Nairobi that wants firewall and endpoint data lining up on the same twelve month timeline instead of two mismatched retention clocks. 

Real World Deployment Scenarios

• A Dubai bank activates the year long retention ahead of a scheduled security audit, so investigators can pull twelve months of endpoint telemetry instead of scrambling to explain a three month gap. 
• A retail group with stores in the UAE and Kenya combines this subscription with Central Firewall Reporting, giving one security team a full year of matched firewall and endpoint data during a fraud investigation. 
• A healthcare provider in Abu Dhabi discovers a slow-moving credential compromise seven months after it started and is still able to trace the full timeline because the extended retention was already in place. 
• An education group in Nepal uses the longer retention window to spot a pattern of after-hours logins across an entire school term, something a 30-day EDR window would never have caught. 
• A construction firm working between Dubai and Nairobi keeps a year of third-party telemetry alongside Sophos data, satisfying an insurance requirement for post-incident evidence. 
• A growing logistics company upgrades its license tier as its device count crosses into the next pricing band, keeping the same yearlong retention without renegotiating the whole contract. 

Why Choose Netmate for Sophos Central Data Storage Subscriptions

Netmate IT operates out of Bur Dubai, UAE, with more than 20 certified cybersecurity engineers who work through license sizing before a client commits to anything. Retention subscriptions like this one are easy to get wrong from the outside. It’s tempting to skip the add-on to save money, right up until an investigation needs data from four months ago and finds nothing there. Netmate’s presales team walks through a client’s compliance obligations and past incident history before recommending whether the standard 90 day window is enough or whether the year-long upgrade actually pays for itself.

The company’s core focus stays on the UAE, with secondary support reaching into the wider GCC, Africa, and Nepal, so renewal timing, license tier changes, and support availability are all built around how businesses in this region actually operate. Whether a client needs a straightforward Data Storage upgrade for a single office in Dubai or a combined rollout with Central Firewall Reporting across branches in Nairobi and Kathmandu, Netmate handles the licensing, activation through Sophos Central, and the support that follows.

Frequently Asked Questions

1. What happens to my data once the 90-day default retention period ends?

Once data passes the retention window, whether that’s 90 days for XDR and MDR or 30 days for EDR, it ages out of the Sophos Data Lake permanently. It isn’t archived somewhere else for later recovery. If nobody pulled a report or ran a query before that data expired, it’s simply gone, which is exactly the gap this subscription is built to close.

2. Does this subscription increase how much data I can upload each day?

No. Daily upload limits stay the same regardless of whether the Data Storage subscription is active. Each device can still upload up to 2 GB per day, and total storage across all devices is capped by pooled limits tied to license count. This add-on only changes how long the data you’re already collecting stays available to query.

3. Can I add this subscription later, or does it need to be purchased upfront?

It can be added at any point during a Sophos Central contract. Keep in mind that retention only extends going forward from activation. Data that already aged out under the shorter default window before you added the subscription cannot be recovered, so businesses that know they’ll need longer retention are better off activating it early rather than waiting until they need to look back at old data.

4. How does this work with Sophos Firewall reporting?

Customers who also hold a Central Firewall Reporting license can pull up to a year of firewall data from the same Data Lake, as long as their firewall license supports it. Pairing the two means firewall logs and endpoint telemetry line up on the same retention timeline, which makes cross-referencing an incident across both data sources much simpler than working with two different expiry dates.

5. Is this subscription required for UAE regulatory compliance?

It isn’t mandated by name under any single UAE regulation, but frameworks like the UAE Information Assurance Regulation expect organizations, especially in banking, healthcare, and government, to maintain evidence of security monitoring and incident response over time. A 90-day window can fall short of what an auditor or regulator expects to see during a review, which is one reason regulated businesses in the UAE tend to add this subscription rather than rely on the default.

6. How is the subscription priced?

It’s licensed in volume tiers based on total user and server count, ranging from small business tiers under 100 licenses up to large enterprise tiers in the tens of thousands. It’s available as a new purchase or a renewal, across a range of contract term lengths. Exact pricing depends on the tier and term, so getting a quote based on actual device count is the most accurate way to budget for it.

7. What if I only need longer retention for some devices, not all of them?

The subscription applies at the account level across your Sophos telemetry and third-party feeds, not selectively per device. If only a subset of your environment genuinely needs a year of retention, it’s worth discussing licensing scope with a partner before purchasing, since the tiering is based on total license count rather than a per-device toggle.