The web service is currently configured to keep access logs, this is not expected to include any sensitive information, but keeping nothing at all feels like a safer bet!
Investigate if there are any legal requirements to retain access logs.
Can logs be switched back on temporarily of required for debugging purposes?
The web service is currently configured to keep access logs, this is not expected to include any sensitive information, but keeping nothing at all feels like a safer bet!