Signed contracts accumulate quickly and quietly. Vendor agreements, client SOWs, leases, NDAs, offer letters, loan documents — each one signed, filed somewhere, and then forgotten until the day someone asks for it.
The question isn't really "how long." It's three questions: how long, measured from when, and what overrides the schedule. Most retention policies get the first right and the second two wrong.
This guide covers US federal and state rules. If you operate elsewhere, the structure applies but the periods won't.
Key takeaways
Most commercial contracts: keep six to seven years after the contract ends, with exceptions below.
The clock starts at expiration or termination, not signature.
Property and basis records outlive everything else, sometimes by decades.
The duty to preserve starts when litigation becomes reasonably foreseeable — not when you're sued.
Keep the signature certificate with the signed PDF. Without it, an e-signed contract is weaker evidence.
Indefinite retention isn't the safe default it feels like.
What to keep, and for how long
Record type | Period | Measured from |
|---|---|---|
General commercial contracts | 6–7 years | Expiration or termination |
Contracts supporting tax positions | 3 years minimum | Filing date of the return |
Bad debt / worthless securities claims | 7 years | Filing date of the return |
Unreported income over 25% of gross | 6 years | Filing date |
No return filed, or fraudulent return | No limit | — |
Employment tax records | 4 years | Tax due or paid, whichever later |
FLSA payroll records | 3 years | Record date |
FLSA supporting records (time cards, schedules) | 2 years | Record date |
Personnel and hiring records (EEOC) | 1 year | Action date; longer if a charge is filed |
Form I-9 | 3 years after hire, or 1 year after termination | Whichever is later |
ERISA plan records | 6 years | Filing date |
Property, leases, improvements (basis records) | Until limitations expire for the disposal year | Sale or disposal, not purchase |
Corporate governance (formation, minutes, stock) | Permanent | — |
Two notes on this table. The IRS employment tax figure and the Department of Labor figures are separate obligations covering overlapping documents, so apply the longest. And the property line is the one most small businesses get wrong: if you buy a building in 2010 and sell it in 2040, the purchase records need to survive until roughly 2044.
Step 1: Classify before you schedule
Group contracts by category — revenue, vendor, employment, real estate, financing, IP, governance — and for each note whether it creates ongoing obligations, supports a tax position, or could plausibly surface in litigation.
The categories map to your templates, so classification is cheapest at the moment of signing. If you're generating agreements from a template library, the category is already known: a vendor agreement, an MSA, a commercial lease and an offer letter each carry a different period. Tag it then rather than reconstructing it from a filename three years later.
Step 2: Understand where the clock actually starts
Retention from expiration is the right policy, but not for the reason usually given.
Limitation periods for breach of contract generally run from the breach, not from signature or expiry. A breach occurring in the final month of a three-year agreement starts its own clock at that point. Some claims involve discovery rules that delay accrual further. So "signature date plus six years" can leave you without records while a claim is still live.
Measuring from expiration or termination is a practical proxy that absorbs most of this. For contracts that end in dispute, extend beyond the standard period rather than applying it mechanically.
Periods vary by state and by contract type. Written contracts commonly fall between three and ten years, with six frequent. Contracts for the sale of goods fall under UCC §2-725, generally four years, and the parties can shorten that by agreement to not less than one year — so read the contract itself, since some agreements set their own limitation period. [LEGAL REVIEW]
Multi-state operations should apply the longest applicable period rather than tracking each separately.
Step 3: Record the trigger date, not just the signature date
A two-year service agreement signed January 2024, completed January 2026, with a seven-year rule, is eligible for destruction no earlier than January 2033.
Capture the effective date, expiration date and renewal terms as structured fields at signing. Auto-renewing contracts need the trigger reset each renewal, and a review flag before the next notice window — missing an auto-renewal notice deadline is a separate and common expense. Systems built for the full contract lifecycle handle this: see automating the contract lifecycle.
Manual date entry is where most retention errors originate.
Step 4: Storage that holds up
Four requirements: searchable, access-controlled, version-preserving, audit-logged. A folder of PDFs on a shared drive meets none of them.
Keep the signature certificate with the document. For electronically signed contracts this is the part people lose. The completion certificate records who signed, when, from where and how they were verified, and it's what converts a PDF into defensible evidence. Store it as part of the record, not as a separate download that goes missing. How audit trails work covers what a good one contains, and types of electronic signatures explains how signature level affects evidentiary weight.
Electronic copies are generally sufficient. Under ESIGN, electronic records satisfy retention requirements where they accurately reflect the information and remain accessible, in a form capable of accurate reproduction. Exceptions exist — negotiable instruments, certain recorded real estate documents, some court filings — so keep paper where a specific rule or counterparty demands it. Digital agreements versus paper contracts covers the comparison.
Plan the exit. If you change platforms, you need the documents and the certificates in a portable format. Confirm export capability before you commit, not during migration. Document management platform considerations covers this and the broader repository question.
Your storage vendor is part of your compliance posture. Encryption at rest and in transit, role-based access, and documented subprocessors. NevTan Sign's security and trust pages set out its approach.
Email is not a records system. It has no version control, no meaningful access control and no audit log, and it's where contracts go to become unfindable. Move executed documents into the repository within a day of signing.
Step 5: The preservation duty overrides everything
This is the part to get right.
The duty to preserve attaches when litigation is reasonably anticipated, not when a complaint is filed or a hold letter arrives. A demand letter, a serious dispute, a regulatory inquiry, a threat during a heated call — any of these can trigger it. Routine deletion continuing past that point is how businesses end up facing spoliation findings, and under FRCP 37(e) courts have a range of sanctions available for lost electronically stored information, up to adverse inference instructions in the worst cases.
Practically:
When a dispute looks plausible, issue a written hold immediately. Identify custodians, name the categories, suspend automatic deletion.
Document the hold, its scope and its date. The hold itself is evidence you acted properly.
Lift it only in writing, once the matter closes.
Run quarterly reviews of what's reached its trigger date, and check for holds, audits and pending transactions before anything is destroyed.
Log every destruction: date, method, approver, authority. You need to be able to explain why a document no longer exists.
Due diligence counts too. During a sale, financing round or audit, suspend destruction. Buyers ask for contracts you were about to delete.
Why indefinite retention isn't the safe choice
Keeping everything feels cautious. Three reasons it isn't:
Discovery scope. Everything you hold is potentially discoverable. More records means broader review, higher cost, and more chance something ambiguous gets read against you.
Privacy obligations. Contracts contain personal data. Under GDPR and similar regimes, storage limitation and data minimisation mean keeping personal data no longer than necessary — so indefinite retention of contracts containing personal data can itself be a violation. GDPR compliance for e-signatures covers the overlap.
Defensibility. A consistently applied schedule is a defence. Ad hoc deletion with no policy looks like selective destruction, even when it wasn't.
The written schedule is the point. It makes the decision in advance, when you're objective, rather than during a dispute when you aren't.
Matching the approach to your business
Solo consultants and small service firms. Seven years from termination for client agreements covers most exposure. A well-organised cloud repository with consistent naming may be enough if you retrieve infrequently.
Employers. Employment records carry the most scattered requirements and the longest tail of claims. If you're generating onboarding paperwork through a workflow, tag retention at that point — e-signatures in HR onboarding covers the document set.
Regulated industries. Healthcare, financial services and government contracting have their own schedules that override general guidance. Note that HIPAA's six-year requirement covers documentation required by the Privacy and Security Rules — policies, risk analyses, training records — while medical record retention is set by state law. Don't conflate the two. [LEGAL REVIEW]
Anyone approaching a sale. Buyers will want complete contract files with signature evidence. Gaps reduce valuation or become indemnity holdbacks.
Common mistakes
Starting the clock at signature. Measure from expiration or termination.
Treating holds as a pre-destruction checkbox. The duty starts earlier.
Conflating the six- and seven-year IRS rules. Seven for worthless securities and bad debts; six for substantial unreported income.
Vague employment retention. The actual rules are specific and multiple.
Losing the signature certificate. The PDF alone is weaker evidence.
Storing contracts in email.
Keeping everything forever and treating it as caution.
No destruction log.
FAQ
How long should I keep a signed contract after it expires?
Six to seven years after expiration or termination covers most commercial agreements. Extend for contracts involving property, ongoing obligations, or anything that ended in dispute.
When does the retention clock start?
At expiration, termination or full performance. Not at signature. Limitation periods generally run from breach, so measuring from the end of the contract is the practical way to cover late-arising claims.
What are the IRS rules?
At least three years generally. Seven years for claims involving losses from worthless securities or bad debt deductions. Six years where income exceeding 25% of gross was unreported. No limit where no return was filed or the return was fraudulent. Employment tax records for four years after the tax was due or paid.
How long for property and real estate records?
Until the limitations period expires for the year you dispose of the property. Purchase documents, improvement receipts and leases establish basis, so they can need to survive for decades.
Do I need paper originals?
Usually not. Electronic records satisfy retention requirements under ESIGN where they accurately reflect the information and can be accurately reproduced. Keep paper for negotiable instruments, certain recorded documents and anywhere a specific rule requires it.
Can I destroy contracts under a legal hold?
No — and the duty starts when litigation becomes reasonably foreseeable, not when you receive a hold notice. Suspend deletion as soon as a dispute looks likely, document the hold, and lift it only in writing.
How long for employment records?
It depends on the record. Payroll three years under FLSA, supporting records two, personnel records one year from the action under EEOC rules, I-9s three years after hire or one year after termination whichever is later, ERISA records six years. Apply the longest that covers each document.
What if I lose a signed contract?
Terms can sometimes be proven through emails, invoices, conduct or partial copies, but reconstruction is expensive and the outcome uncertain. This is what the repository exists to prevent.
