How long should a small startup keep security logs before it becomes pointless overhead?

CybersecuritySecurityLoggingCompliance

We're logging auth events, API access, and admin actions but retention is unbounded right now and storage costs are creeping up. What's a sensible default retention window for a 15-person startup without dedicated security staff?