There is no single answer to how long you should keep compliance records. The right period depends on what each record documents, what laws apply to your business and what your contracts require. That makes retention a business and legal decision, best made with a qualified lawyer and your accountant.
What you can control today is how you keep records: what you keep, for how long under a written policy, who can see it, and whether you can produce it in a usable form when someone asks. This guide covers those principles.
Why there is no single retention period
Even for tax records, the IRS says the length of time to keep a document depends on the action, expense or event the document records. It also warns that before discarding records, you should check whether others need them, noting that insurance companies or creditors may require you to keep them longer than the IRS does.
Compliance records work the same way. A record of a buyer's signed statement, a held order or a refund may matter for tax, for disputes, for contracts with your payment processor and suppliers, and for any questions about how you ran your business. Each of those can point to a different period. Read your own agreements for any record-keeping terms they contain, and ask your advisers to set periods for each type of record.
What counts as a compliance record
For a research supply business that sells to business and research buyers, compliance records usually include:
- Buyer checks and the declarations buyers made at site entry or checkout.
- Signed buyer statements, and the exact version of the wording each buyer saw.
- Order holds, who reviewed them and what they decided.
- Payment events, refunds and dispute correspondence.
- Shipping and delivery records.
- Versions of your policies, terms, product pages and checkout copy, with dates.
- Monitoring findings and the changes you made in response.
- Admin actions, such as changes to settings or user roles.
Our checklist of payment records worth keeping goes into more detail on the order and payment side.
Principles for keeping records
Keep what you need, for as long as you need it
The FTC's guide to protecting personal information advises businesses to keep personal information only as long as there is a legitimate business need for it, and to develop a written records retention policy. Compliance records often contain personal details about buyers, so this applies directly. Keep what supports your business and legal needs, and do not collect extra data just because a form allows it.
Apply one policy consistently
A retention policy only helps if it is followed the same way every time. Apply the same periods to the same kinds of record, regardless of whether an order was routine or unusual. Inconsistent deletion is hard to explain later.
Limit who can see records
The FTC guide recommends limiting access to employees with a legitimate business need. In practice that means separate roles: people who run the store day to day, people who review orders and compliance findings, and an owner who controls settings. See compliance roles for small teams.
Make records findable and exportable
Records are only useful if you can produce them. Store them against the order or event they relate to, use consistent dates and identifiers, and make sure you can export a date range in a format someone outside your team can read. Our guide to exporting compliance evidence for a review covers how to present an export.
Protect integrity
A record that could have been edited without trace is weaker evidence than one where changes are visible. Tamper-evident storage, where altering an earlier entry breaks a check, helps show that records were not changed after the fact. See tamper-evident records, explained.
Dispose of records properly
When a retention period ends, deletion should be deliberate and documented. The FTC guide advises disposing of personal information so that it cannot be read or reconstructed, and gives shredding, burning or pulverizing as ways to dispose of paper records.
Plan for incidents
The FTC guide also recommends having a plan in place to respond to security incidents. Decide in advance who leads, how you investigate and how you decide whom to notify.
Writing a simple retention schedule
- List every type of compliance record you create, using the list above as a starting point.
- For each type, note where it is stored and who can access it.
- Ask your lawyer and accountant to set a retention period for each type, and record the reason.
- Write the schedule down, with an owner and a date it was approved.
- Set access by role and review the list of people with access on a regular schedule.
- Decide how records will be exported, and test an export before you need one.
- Decide how records will be disposed of at the end of the period, and log each disposal.
- Review the schedule when your business, your agreements or the rules that apply to you change.
Where Claddr fits
Claddr stores buyer checks, signatures, holds and payments against each order in an audit record where each entry is chained to the one before it, so a change after the fact breaks the chain. You can export a date range: the PDF summarizes the controls in force, such as your profile, gate settings and statement versions, and the CSV lists every entry with its hash. Access is split between owners, admins and compliance reviewers, and every admin action is logged.
It does not decide your retention periods. Those remain your decision, made with your advisers.
Limits of this guide
This guide describes general principles. It does not tell you how long you are required to keep any record or what privacy rules apply to you. Speak to a qualified lawyer about your business.