Trust Center
Data Retention & Secure Disposal
We keep client information only for as long as the contract or the law requires, and we dispose of it securely. This schedule is the default; client contracts may set different periods.
1. Principles
- Keep only what is needed for the engagement and legal obligations.
- Keep it securely for as long as it is kept.
- Return or destroy it securely when the period ends, and confirm in writing.
2. Default retention schedule
| Record type | Default retention | Notes |
|---|---|---|
| Working copies of client source documents | Until the engagement ends, or as agreed | Returned or deleted at exit |
| Engagement workpapers and deliverables | Up to 8 years | Aligned with typical statutory limitation and assessment periods; client may instruct earlier return |
| Engagement letters, NDAs, DPAs | Duration of relationship plus 8 years | Needed to evidence terms and obligations |
| Access register and security logs | At least 1 year, or as required by applicable directions | Supports incident investigation |
| Enquiries from the website | Up to 3 years | Deleted earlier on request |
| Data held inside client systems | Controlled by the client | Our access is revoked at exit |
3. Secure disposal
- Electronic files are permanently deleted from all locations, including shared folders, trash or recycle bins and any temporary copies.
- Paper records are cross-cut shredded.
- Devices leaving the firm are wiped using secure methods before disposal or reuse.
- Where a client asks for return rather than deletion, data is returned through the agreed secure channel before deletion.
4. Legal holds
Where records are required for ongoing proceedings, assessments or disputes, disposal is suspended for those records until the matter concludes, and the client is informed.
Questions about security?
We are happy to complete your vendor-security questionnaire and walk your team through our controls.