> when required by law

Suggests there's a longer term storage, available for hackers.

There doesn't have to be storage, NSA could always just force them to add it in later without telling you. Like every single USA company.