Extended Data Retention

The Extended Data Retention add-on helps internet service providers meet the traffic-data retention duty (Czech §97 of the Electronic Communications Act and Decree 357/2012). It keeps a register of which client used which IP address and when, guarantees that flows are kept for the legal period, answers "who used this IP address at that time" requests from the authorities, and logs every access to the retained data.

License: add-on "Extended Data Retention" (available for any paid tier; included in the trial).

The Overview tab checks whether the instance can answer a data-retention request right now. Red items mean a request cannot be answered reliably (empty register, failing sync), amber items are warnings — including a retention shorter than the legal minimum.

The maximum flow retention is set by the licence tier (Free 30, Core 180, Security 365 days, Enterprise unlimited); in Settings → Data retention you can choose a shorter period. The legal minimum for traffic data is 6 months (190 days with a margin). The Overview tab compares the configured value with the TTL really set on ClickHouse and with the licence cap, and shows how many days the data covers, the daily growth and the estimated disk usage.

• •"Set TTL to the configured value" — applies the stored setting to ClickHouse (fixes drift)
• •"Raise to the legal minimum" — sets and saves 190 days; if the licence allows less, "Raise to the licence maximum" sets the licence cap instead
• •A retention below the legal minimum is reported as a warning — it is the administrator's decision (or a licence limit), not an error
• •Settings → Data retention marks the flows row "below legal minimum" when it is shorter

The Clients tab shows the current state of the register. Every change — from an import or an ISPadmin sync — is also written to the assignment history: when an address moves to another client, the old assignment is closed and a new one opened. Flow search, the regulatory export and the lookup always use the assignment that was valid at the time of the flow, not today's state.

• •Search by IP, name, MAC, client number, street or city (accent-insensitive)
• •History icon — all assignments of the address over time
• •Lookup icon — opens the Lookup tab prefilled with the address
• •Map icon — client location when GPS coordinates are known

The Lookup tab answers the typical request "who used IP address X (port Y) on date Z". It searches flows on both sides and both before and after NAT, so it works for public addresses behind CGNAT and for port-forwarded (DNAT) traffic.

• •Enter the IP address, optionally the port, the local time and a tolerance (exact to ± 1 h)
• •Optionally fill in the request reference number and the requester — they appear in the report and the audit
• •"Users at that time" — the clients found, with ID, client number, address, MAC and the first/last matching flow
• •Flow table — the matching flows (the searched side highlighted)
• •"PDF report" — a protocol with the request reference, requester, operator, query and results, ready to hand over

In Flow collector → Flows, the export button (part of this add-on) offers a standard and a regulatory export (CSV, XLSX, PDF). The regulatory export uses the fixed layout of Decree 357/2012: connection type, user designation, account identifier, MAC, start and end, source, destination and post-NAT IP:port, volume, protocol, access point, ESSID and GPS.

• •The user is the client valid at the time of each flow (source side, or the destination side for inbound connections)
• •The regulatory CSV is streamed, so even large exports (up to 500 000 rows) do not run out of memory
• •The export endpoint itself checks the add-on and every export is written to the access audit

Labels for the numeric service_type codes from the register (e.g. 1 = fibre, 2 = Wi-Fi). The label is used as the "connection type" in the regulatory export. Codes found in the register are listed automatically; an admin can add a label for any code, also one not used yet.

Instead of CSV imports, the register can be pulled daily from an ISPadmin server over its REST API: client name per IP (/internet), client number and ID (/clients) and the installation address (/clients/{id}/services).

• •Server URL — HTTPS only (the API token travels with every request); LAN servers are allowed
• •API token — stored encrypted; leave the field empty to keep the current one
• •Sync time — daily run time (default 01:30); exactly one run per day even with several API workers
• •Test connection / Sync now — the sync runs in the background; the page shows progress and the result
• •Sync history — result of every sync and import with the number of added, changed and removed clients

Retained traffic data may only be used for the purposes set by law, so every access is recorded: flow exports, lookups and PDF reports, register searches and history views, imports, synchronizations and configuration changes — with the user, role, IP address, parameters and number of records. Records are kept for 3 years. Admin only.

• •Who — public communication network and service providers (ISPs, operators)
• •What — traffic data (who, with whom, when, how long, how they communicated) and location data
• •Duration — 6 months
• •Deletion — after 6 months, data must be deleted unless it was handed over to the authorities
• •Purpose — exclusively for the Czech Police, intelligence services (BIS) or the Czech National Bank