Records retention

How long must we keep records, and when can they be deleted? This page gathers the main retention periods in one place. The formal rules are in the policy or SOP named in each row.

Retention periods

Record Keep for Source
Executed contracts (MSAs, SOWs, amendments) The contract term plus 7 years Legal
Incident records 7 years SOP-001 v2
Leave records 7 years POL-HR-001 v2
Device wipe certificates and wipe records 7 years SOP-IT-009
Access review results 3 years SOP-IT-003
Daily backups 35 days SOP-IT-002 v2

What changed from older versions

  • Incident records were kept for 3 years under version 1 of SOP-001. Version 2 changed it to 7 years.
  • Daily backups were kept for 14 days under version 1 of SOP-IT-002; they are now kept for 35 days.

Practical rules

  1. Keep the signed original of every contract with Legal, not only on a personal drive.
  2. Do not delete a record that is still inside its retention period, even if the project is closed.
  3. If a legal hold is placed on a record, retention periods are suspended until Legal lifts it.
  4. When a period has ended, ask the record owner before deleting.

Gifts

Gifts above $100 per person per year must be reported (POL-LEG-004); see Gifts and conflicts.

Owner: Marcus Webb - Last updated: 2026-09-23