Security

Where your tax documents end up

The documents you must keep by law almost always live in an external service chosen years ago and never discussed since. Three questions matter: who holds them, in what format they are returned, and what happens if the provider shuts down. Responsibility for retention stays with whoever issued the document, not with whoever hosts it.

28 Feb 2026 · 9 min read · updated on 27 Aug 2026

Try answering these three questions without calling anyone: where are your invoices from the last five years? Who, besides you, can access them? If that service closed tomorrow, how long would it take to get them back?

In most companies the first answer is vague ("the accountant has them", "there's a service"), the second is unknown and the third doesn't exist. Yet these are documents you are obliged to keep for years and that will be requested at the least convenient moment: an inspection, a dispute, a due diligence.

Responsibility isn't delegated along with the file

This is the point that surprises most. You can entrust archiving and retention to a provider, but the duty to produce the documents stays yours. If the service loses the data, you are the one answering to an inspection — then, perhaps, you pursue the provider, at the speed of civil litigation.

That changes the nature of the questions to ask. Not "are you good?", but: what do you give me back, in what format, in what time, and what happens if you close.

The document isn't where you see it: it's where someone keeps it for you. Two different things, and only one counts in an inspection.The distinction almost everyone misses

Five questions for the provider

Who physically keeps the documents? Many providers rely on a third party themselves. Not a problem as such, but you must know it and it must be written down, because the chain gets longer.
What do you return if I leave? A complete archive with the documents and the data proving their retention, or just loose PDFs? The difference matters: the proof of retention is part of the document.
In what time, and at what cost? Data extraction at the end of the relationship is a line some contracts charge dearly for. Agree it beforehand.
Who on your side can read our documents? And is there a record of who did? These contain data about your customers and your staff.
What happens if you cease trading? Is there a transfer procedure, or do our documents end up in an insolvency? The most uncomfortable question and the most important.

The test you can run this afternoon

No audit needed. Pick three documents: an invoice from four years ago, a signed contract and a payslip. Try to retrieve them yourself, without asking anyone for help, with a stopwatch.

What you learn in half an hour is worth more than any reassurance. In our experience the typical result is: the first is found, the second is in somebody's mailbox, the third needs a call to an outside consultant. Each of those three answers points to a different action.

Three rules that solve most cases

One copy must be under your control. Not instead of the retention service, but in addition: an archive of your own, refreshed periodically, readable without the provider. It is the difference between an inconvenience and a crisis the day the service doesn't answer.
The format must be readable in ten years. PDF and open formats yes; formats proprietary to a single product no. Retention rules speak of readability over time, and it isn't a formality: it is the reason retention exists.
Who does what must be written down. You, the accountant, the retention provider: who sends, who keeps, who answers a request. If that split isn't written, when something goes wrong everyone will point at someone else.

The link with personal data

Invoices and payslips contain people's data, so retention is also a data protection matter: whoever hosts the documents processes data on your behalf, and a written agreement saying so, with the appropriate guarantees, is required.

There is then a point that looks like a technicality and isn't: the duty to retain beats the right to erasure. If a customer asks for their data to be deleted, the invoice stays — it is a document the law requires you to keep. What can be done is to separate: what is legally required stays, the rest is anonymised. Decide and write it down before someone asks, not after.

Nobody deals with this subject until they have to, which is exactly why it deserves half a day now, when there is no urgency and you can still choose calmly.

Doesn't our accountant keep everything anyway?

They keep what falls under their engagement, using tools they chose. Contracts, commercial correspondence, technical documents and much else stay yours and nobody handles them unless you do. Ask exactly what is covered: the answer is almost always narrower than you imagine.

Is saving PDFs in a folder enough?

For documents the law requires to be retained in a specific way, no: integrity and readability over time also count. For everything else an orderly copy under your control is still better than nothing, and today it often doesn't exist.

How long must documents be kept?

Periods vary by document type and some extend in case of disputes or assessments. The practical approach is to get a list by category, with the periods, from your advisor and keep it with the documents themselves: it is the thing nobody has and everybody needs.

What if the provider closes overnight?

If you have your own copy, it is a change of supplier. If you don't, it depends entirely on what the contract said and how the insolvency proceeds. That is why the first of the three rules is not excessive caution.