Record Retention Policy
Scott Recycling's record retention policy defines how long different categories of records must be kept, where they're stored, and how they're destroyed at end-of-life. This policy exists to satisfy legal, regulatory, and business requirements while avoiding the cost and risk of indefinite retention.
Why Retention Matters
Records that are kept too long create:
- Legal discovery risk — old records become evidence in lawsuits
- Storage cost — physical space and digital overhead
- Privacy exposure — more data = bigger breach if it occurs
- Compliance risk — regulators expect documented destruction of outdated PII
Records that are destroyed too soon create:
- Legal liability — destroying records during active litigation = sanctions
- Regulatory violations — FMCSA, HIPAA, IRS all have minimums
- Business continuity gaps — customer history, warranty claims, audit trails
The policy below is the floor. When in doubt, keep longer. When actively sued or under investigation, keep everything — see "Legal Hold" below.
Retention Schedule
Customer & Operations Records
| Record Type |
Retention Period |
Storage Location |
Notes |
| Customer records (contact, pickup history) |
7 years after last activity |
Odoo (primary), backup |
Active CRM record; archive inactive records after 3 years |
| Pickup tickets / weight receipts |
7 years |
Odoo customer_pickups |
Primary business record |
| Customer agreements / MOUs |
7 years after termination |
Odoo + physical file |
Signed originals kept in physical file |
| Chain of custody records |
Permanent |
Odoo + offsite backup |
Required for R2 and compliance audits |
| Destruction certificates |
Permanent |
Odoo + offsite backup |
HIPAA and customer compliance — never destroy |
| Complaint / incident records |
7 years |
Helpdesk + physical file |
Customer complaints, resolution |
Financial Records
| Record Type |
Retention Period |
Storage Location |
Notes |
| General ledger / journals |
7 years |
QuickBooks Online |
Per IRS guidance |
| Tax returns and supporting docs |
7 years |
QBO + physical |
Some states require longer |
| Payroll records |
7 years |
External payroll + HR |
Per FLSA |
| Bank statements |
7 years |
Bank archives + downloads |
|
| Invoices (sent and received) |
7 years |
QBO + Odoo |
|
| Expense receipts |
7 years |
QBO |
|
| Asset records (purchase + depreciation) |
Life of asset + 7 years |
QBO |
For fixed assets |
| Audit reports |
Permanent |
Physical file |
External audit documentation |
Employee Records
| Record Type |
Retention Period |
Storage Location |
Notes |
| Personnel files (active employees) |
Duration of employment |
HR file cabinet (locked) |
I-9, application, reviews, discipline |
| Terminated employee files |
7 years post-termination |
HR archive |
Per EEOC |
| Time sheets / attendance |
3 years |
Odoo sr_attendance |
Per FLSA minimum |
| Payroll records |
7 years |
External payroll |
Per FLSA |
| I-9 forms |
3 years after hire OR 1 year after termination (whichever is later) |
HR file cabinet |
Per USCIS |
| Benefits records |
6 years |
HR archive |
Per ERISA |
| Workers' comp claims |
5 years (TN) |
HR + insurance |
Check TN statute of limitations |
| Medical records (employee) |
Duration + 30 years |
HR medical file (HIPAA-controlled) |
Per OSHA 29 CFR 1910.1020 |
| Training records |
Duration of employment + 3 years |
Odoo hr_skills + physical |
Certification proof |
| Performance reviews |
7 years |
Odoo sr_evaluations |
|
DOT / Fleet Records (FMCSA Requirements)
| Record Type |
Retention Period |
Storage Location |
Notes |
| Driver qualification files |
Duration of employment + 3 years |
HR/fleet file |
49 CFR 391.51 |
| Driver's application |
3 years |
HR/fleet file |
Per FMCSA |
| Motor vehicle records (MVR) |
3 years |
HR/fleet file |
Annual check required |
| Road test certificates |
Duration of employment + 3 years |
HR/fleet file |
|
| Medical examiner's certificate |
3 years |
HR/fleet file |
Must be current |
| Drug/alcohol test records (positive) |
5 years |
HR/fleet file (locked) |
Per DOT |
| Drug/alcohol test records (negative) |
1 year |
HR/fleet file |
Per DOT |
| Hours of service (HOS) records |
6 months |
Odoo + paper logs |
Per 49 CFR 395.8 |
| Vehicle inspection reports (DVIR) |
3 months |
sr_maintenance |
Per 49 CFR 396.11 |
| Vehicle maintenance records |
1 year + 6 months after vehicle leaves fleet |
sr_maintenance |
Per 49 CFR 396.3 |
| Accident records |
3 years from accident date |
Fleet file + insurance |
Per 49 CFR 390.15 |
HIPAA Records
| Record Type |
Retention Period |
Storage Location |
Notes |
| HIPAA policies and procedures |
6 years from creation or last effective date |
sr-docs + physical |
Per 45 CFR 164.530(j) |
| HIPAA training records |
6 years |
hr_skills + physical |
|
| Business Associate Agreements |
6 years after termination |
Physical file |
|
| HIPAA breach documentation |
6 years |
Physical file (locked) |
|
| Destruction certificates (HIPAA material) |
Permanent |
Odoo + offsite |
Customer compliance evidence |
Environmental / EPA Records
| Record Type |
Retention Period |
Storage Location |
Notes |
| Hazardous waste manifests |
3 years minimum |
Physical + Odoo |
Per RCRA; longer if state requires |
| CRT shipping records |
3 years |
Physical + Odoo |
Per EPA CRT rule |
| Battery disposal records |
3 years |
Physical + Odoo |
|
| TDEC permits and correspondence |
Life of permit + 3 years |
Physical file |
|
| Spill response incident reports |
Permanent |
Physical file |
Environmental liability evidence |
IT / System Records
| Record Type |
Retention Period |
Storage Location |
Notes |
| Odoo database backups |
14 days (rolling) |
/opt/backups/odoo/ |
Set up 2026-04-12 |
| System logs (application) |
30 days |
Server logs |
Rotated automatically |
| Access logs / audit trails |
1 year |
Server logs |
Security audit |
| Security incident reports |
Permanent |
Physical file + digital |
Breach evidence |
| User access records |
Duration of access + 1 year |
Odoo user table |
Who had what access when |
Legal & Corporate Records
| Record Type |
Retention Period |
Storage Location |
Notes |
| Articles of incorporation |
Permanent |
Physical file |
|
| Operating agreement / bylaws |
Permanent |
Physical file |
|
| Board/member minutes |
Permanent |
Physical file |
|
| Contracts (vendor, customer, lease) |
7 years after expiration |
Physical + digital |
|
| Leases |
10 years after expiration |
Physical file |
|
| Insurance policies |
Life of policy + 10 years |
Physical file |
Long-tail claims |
| Litigation files |
Permanent |
Attorney + physical |
|
Storage Standards
Digital Records (Primary)
- Odoo database: Primary storage for most operational records
- QuickBooks Online: Primary storage for financial records
- Backups: Nightly
pg_dump of Odoo to /opt/backups/odoo/ on EXP server (14-day retention)
- Offsite backup: (PENDING — to be implemented) weekly offsite copy of latest backup
- Access control: Role-based permissions in Odoo; limited admin access
Physical Records
- Locked file cabinets for: personnel files, medical records, HIPAA documentation, signed contracts, tax records, legal files
- Fire-resistant safe for: articles of incorporation, insurance policies, critical legal documents
- Climate-controlled area for long-term physical archives
- Labeled clearly by year and record type
- Inventory maintained so retrieval is possible within 1 business day
Destruction Procedures
When a record reaches end of retention, it must be destroyed securely.
Digital Destruction
- Odoo records: archive first, then delete after additional review period
- Backups containing destroyed records: naturally cycle out within 14 days
- System logs: automatic rotation
- HIPAA/PHI records: use
sr_ewaste_compliance destruction workflow with certificate generation
Physical Destruction
- Routine paper: shredding (cross-cut, minimum)
- Sensitive paper (PII, financial, medical): cross-cut shred + witnessed destruction log
- Electronic media: NIST 800-88 (see Data Destruction Procedures)
- Document destruction log: what was destroyed, when, by whom, witnessed by — kept permanently
Legal Hold
If Scott Recycling is served with a lawsuit, subpoena, or notice of investigation, retention periods are SUSPENDED for any records potentially relevant to the matter.
Legal hold procedure:
1. Notify: Dan (or designated backup) notifies all relevant staff immediately
2. Document: written legal hold notice distributed via email + posted
3. Freeze: stop all routine destruction of affected record categories
4. Preserve: including backups, emails, chat messages, Odoo records
5. Do NOT destroy anything until legal counsel confirms the hold is lifted in writing
Violating a legal hold (even accidentally) can result in sanctions, adverse inference at trial, or criminal charges. When in doubt, preserve.
Responsibilities
| Role |
Responsibility |
| Dan (owner) |
Policy approval, legal hold decisions, final retention judgment calls |
| HR Manager |
Personnel, payroll, medical, training records |
| Dispatch/Fleet Manager |
Driver qualification files, DOT records, vehicle maintenance records |
| Compliance Officer |
HIPAA records, environmental records, destruction certificates |
| IT Administrator |
Digital backups, system logs, access control, technical destruction |
| Accountant |
Financial records, tax records, audit files |
Review Schedule
- Annual review of this policy by Dan + legal counsel
- Quarterly destruction sweeps of expired records (digital and physical)
- Incident-triggered review if any retention gap is identified