Is the original non-normalized record of logs kept in a repository for forensic purposes prior to deletion?

Yes. All original data is secured and replicated in an active-active state on the two Alert Logic® data grids as a part of the standard service delivery. Customer access is available through the Alert Logic console under Search > Log Messages, where searching, alerting, correlating, and reporting of all log data is available.