SOC 2 data retention requirements: set the period, then prove you follow it

Updated 25 October 2026

SOC 2 does not say how long to keep any data. The criteria expect you to decide a period for each category, to keep confidential information only while it is needed, to dispose of it when the time is up, and to make data and devices unrecoverable first. The auditor then tests your own policy against your settings and your records. This guide covers what you have to decide, what disposal evidence looks like, what to promise customers when a contract ends, and where backups and logs complicate the answer, with the Policyseed Data Retention and Disposal Policy quoted as one concrete example.

Short answer: the criteria set no number, your policy does

A SOC 2 report is written by a CPA firm after it examines your controls against the Trust Services Criteria. Those criteria describe outcomes and leave periods to you. The four outside guides we read agree on that and differ on what to do about it:

All four publishers sell or promote compliance work, so read them as one side, and none of them is the AICPA. The useful overlap is that nobody cites a criterion that fixes a period; every figure is a recommendation, a legal rule from somewhere else, or an example. Where they disagree, such as on how long to keep audit evidence, your CPA firm and your customer contracts are the real sources for a minimum.

The criteria this touches

The generated Data Retention and Disposal Policy is mapped to three criteria in the Policyseed crosswalk. The wording is a paraphrase, not the AICPA text:

• C1.1 (Identifying and protecting confidential information): The company defines what counts as confidential, labels or classifies it, and applies handling and retention rules so it stays protected for as long as it is kept.
• C1.2 (Disposing of confidential information): When confidential information is no longer needed or a customer asks for deletion, the company deletes it from systems and backups within a defined time and can show that it did.
• CC6.5 (Disposal of physical assets): When laptops, drives or other equipment leave the company's control, the data on them is wiped or destroyed first, and the disposal is recorded.

Two things to know about scope. C1.1 and C1.2 sit in the Confidentiality category, which is optional; CC6.5 is in the Security category that every report includes, so disposal of devices and data is tested either way. The Policyseed crosswalk covers Security, Availability and Confidentiality, so if the Privacy category is in your scope, ask your CPA firm which of its criteria apply. Backups also relate to A1.2 when Availability is in scope, and removable media to CC6.7. For the whole map, see the SOC 2 controls list.

What you must decide

Because nothing is prescribed, the work is a set of decisions that you write down once and then follow. The crosswalk lists a retention schedule among the evidence for C1.1; the decisions go in it:

• Categories. Which kinds of data you hold: customer data, backups, logs, support tickets, billing, employee records, source code, devices. Split a category when parts of it are kept for different periods.
• Period and trigger. How long each is kept, and the event the clock starts from, such as end of contract or end of employment. A period with no trigger cannot be applied.
• Basis. Why: a customer commitment, a legal rule, or business need. A legal rule depends on your jurisdiction and your contracts, so have someone who knows them confirm it.
• Disposal method and owner. How data is destroyed and who is accountable for it happening.
• Evidence. What record each disposal leaves, which is the part the auditor samples.

The generated policy puts the first rule in plain terms:

Data Retention and Disposal Policy, 4.1: Northwind Cloud Inc maintains a written retention schedule (Section 5.1) listing each data category, its system of record, retention period and disposal method. Data is kept no longer than its business purpose, contractual commitment or legal obligation requires, whichever is longest, and is disposed of promptly afterward.

The excerpts on this page are not written by hand. They are rendered from the policy template for the Northwind Cloud Inc sample intake, so they change when the template does, and the company, cloud and tool names in them are the sample's. The periods are the template's defaults. They are not taken from a criterion, so change them to match your contracts and your systems before you adopt the policy.

Periods you will see, and whose they are

Searching for a number turns up a mix of sources that are easy to confuse. These are the figures in the guides above and in the template, each with who says it. None of them is a SOC 2 requirement, and where a figure is a legal rule it applies to the businesses and records that rule covers, so check your jurisdiction.

The sources disagree with each other and with the template, and that is fine because the template's numbers are defaults. Employment records are the clearest case: one guide gives a 3-year example and the template says 7 years or longer where law requires. The 7-year template figure is a longer, more cautious choice and not a claim about what the law demands. In the version we read, Konfirmity's page treats the ISO 27001 log figure inconsistently, first as an ISO recommendation and later as a suggestion from AuditBoard, while Axipro states ISO 27001 sets no fixed period. For personal data, the GDPR approach per Konfirmity is that no fixed period is given and storage must not exceed what is necessary. The template's own rule for personal data is the one in statement 4.6:

With personal, health and payment data in the answers: Data Retention and Disposal Policy, 4.6: Data subject to specific legal or regulatory retention rules follows those rules, which take precedence over the general schedule. Personal data is retained only as described in the privacy notices given to individuals, and verified deletion requests are fulfilled within 30 days. Documentation required by the HIPAA Security Rule is retained for at least six years from creation or last effective date. Cardholder data is never stored after authorization except as processor-issued tokens, and sensitive authentication data such as CVV codes is never stored.

If health data is in scope, the HIPAA guide for SaaS startups covers where those rules come from. This page does not tell you which law applies to you.

Disposal evidence: the part that gets sampled

Setting a period is a document. Disposal is an event, and C1.2 is tested by looking for the event. Konfirmity's checklist is a good shape: confirm the period has ended, verify no legal hold applies, destroy the data, record the deletion event with a timestamp, the system, the data category and the person responsible, and review the deletion logs for gaps (Konfirmity). WatchDog lists deletion tickets, system logs and certificates of destruction for media (WatchDog Security), and AuditFront adds lifecycle configurations and retention audit results (AuditFront). The Policyseed crosswalk lists these as C1.2 evidence:

• Customer offboarding or deletion request records with completion dates
• Database or object storage lifecycle policy screenshot enforcing the retention schedule
• Backup retention configuration showing when deleted data ages out of backups
• Disposal log entries for decommissioned systems or devices

The generated policy makes the log and the audit part of the rules:

Data Retention and Disposal Policy, 4.12: Disposal of Confidential or Restricted data and of hardware that has held company data is recorded in the disposal log with date, method, performer and verifier.

With Confidentiality in scope: Data Retention and Disposal Policy, 4.12: Disposal of Confidential or Restricted data and of hardware that has held company data is recorded in the disposal log with date, method, performer and verifier. Because Confidentiality is within the scope of Northwind Cloud Inc's SOC 2 examination, disposal records are retained as evidence for the full examination period.

Data Retention and Disposal Policy, 5.8: Quarterly retention audit. The Security Owner samples each category, confirms the oldest records do not exceed their retention period, checks the disposal log for completeness and records the results. Findings become issues with a 30-day remediation deadline and are reported to Executive Management.

Data Retention and Disposal Policy, 5.2: Automated deletion. Engineering configures lifecycle rules, time-to-live settings or scheduled deletion jobs for each category and documents them alongside the schedule; changes follow the Change Management Policy. Each quarter Engineering confirms every rule is present and executed successfully and attaches the evidence to the retention audit.

In practice each kind of data leaves a different record. This table follows the free schedule's starter rows and the policy's procedures:

The methods themselves are the template's choice, and the policy names them:

Data Retention and Disposal Policy, 4.7: Electronic data is disposed of by cryptographic erasure, provider-level deletion followed by expiry of associated snapshots, or overwriting, so that it cannot be reconstructed with commercially reasonable effort. Media leaving Northwind Cloud Inc's control is purged or destroyed per NIST SP 800-88 Rev. 1; paper is cross-cut shredded.

With a device management tool named: Data Retention and Disposal Policy, 5.5: Device disposal. People Operations collects devices at offboarding or replacement and records receipt in the asset register. Engineering issues a remote erase through Kandji and retains the completion record. Devices leaving the company go to a certified recycler whose certificate of destruction is attached to the asset record.

Collect the evidence across the whole period, not once. The auditor of a Type II report samples across the observation period, so a quarterly check that stops in the third quarter is visible. The SOC 2 evidence checklist covers collecting evidence across a period, and fieldwork shows how the samples are drawn.

Customer data when the contract ends

This is the retention commitment customers read. Konfirmity has no dedicated section on it and only mentions contract terms that make vendors destroy data and attest to it (Konfirmity), while WatchDog recommends automated deletion workflows on offboarding or when periods expire, and says startups can delete manually on request or termination and log the action (WatchDog Security). The generated policy turns that into dates and steps:

Data Retention and Disposal Policy, 4.3: Customer data in Northwind is retained for the term of the customer agreement and deleted within 30 days after termination or after a verified written deletion request, unless a legal hold applies. Northwind Cloud Inc confirms deletion in writing on request.

Data Retention and Disposal Policy, 5.3: Customer deletion requests. Requests arriving through support or security@northwindcloud.example are verified as coming from an authorized customer representative, ticketed and assigned to Engineering, which deletes the data from production within 30 days and confirms no copies remain in non-production environments. Support confirms deletion to the customer in writing.

Data Retention and Disposal Policy, 5.4: Customer offboarding. When an agreement ends, the account enters a read-only export state so the customer can export its data, and the deletion procedure in 5.3 completes within 30 days of termination, the window in 4.3. Where sub-processors such as Supabase, Stripe, Datadog and Slack hold the customer's data, Engineering triggers deletion in each within the same window and records the confirmation.

Three things to check before you adopt this. The 30 days is the template's default and a customer agreement that says otherwise prevails, which the policy says in its scope section. The read-only export state means customers can get their data out before it is deleted. And if you tell customers deletion takes 30 days, your backups and your sub-processors need to be able to meet that, which the next sections cover. The same promise often appears in the security questionnaire answers, so keep the wording consistent. Vendors that process your data are covered by their own clause:

Data Retention and Disposal Policy, 4.10: Vendors that process Northwind Cloud Inc or customer data must be contractually obliged to delete or return it within 90 days after the service ends and to confirm deletion on request. This is verified during vendor reviews for Supabase, Stripe, Datadog and Slack.

Backups and logs: why deletion is never instant

Backups and logs are where a clean retention policy meets reality. A deleted customer record can still sit in last night's backup, and a log line can carry an identifier. AuditFront suggests letting backup rotation expire old data rather than selectively deleting from backup media, and documenting that data may persist in backups for the backup retention period (AuditFront). Konfirmity says backup retention should follow the business continuity plan (Konfirmity). The template picks a rolling window and ties deletion to it:

Data Retention and Disposal Policy, 4.4: Backups follow the Daily schedule in the Backup and Recovery Policy and expire automatically no later than 35 days after creation through AWS Backup lifecycle settings. Deleted production data is fully purged once the last backup containing it expires; personnel do not restore backups to circumvent a deletion.

The consequence is that a customer who asks for deletion is not fully gone from backups until the window ends, so the written promise should say so. The Backup and Recovery Policy holds the schedule and restore tests, and the free backup restore test log records them. A short retention window also limits how far back you can restore, so agree the number with whoever owns recovery.

Logs have the opposite pull: you want to keep them long enough to investigate. The template says:

Data Retention and Disposal Policy, 4.5: Security and audit logs are retained for 12 months and application debug logs for 30 days, consistent with the Logging and Monitoring Policy, unless a legal hold or documented investigation requires longer.

The reasoning for the log period, the common figures and how the auditor tests them are in the SOC 2 logging requirements guide, so this page does not repeat them. The point for retention is the conflict: logs and audit evidence argue for keeping, data minimization argues for deleting. Axipro describes exactly this tension and recommends separate schedules, redacting what auditors do not need and deleting on schedule while keeping a record of the deletion (Axipro). Keeping personal data out of log records in the first place solves more of it than a shorter period does.

Legal holds beat the schedule

A legal hold suspends deletion. Axipro's warning is that automated deletion is the easiest way to miss one, so confirm in advance that your lifecycle rules and retention settings can be paused and test that they pause (Axipro). The template builds this in: a hold suspends the automated deletions it covers, and the Security Owner records the hold and its release.

Data Retention and Disposal Policy, 4.9: A legal hold suspends every deletion that would otherwise apply to the data it covers. Only Executive Management, on advice of counsel, initiates or releases a hold; the Security Owner records each hold, its scope and its release in the legal-hold register.

Data Retention and Disposal Policy, 5.7: Legal hold. Executive Management notifies the Security Owner in writing of the matter, custodians and data categories. Within two business days the Security Owner suspends the relevant automated deletions, instructs custodians in writing, records the hold in the register and reviews it quarterly until Executive Management releases it in writing.

The disposal log in the free schedule has a column to confirm no hold applied before anything was destroyed. When to place a hold is a legal question for counsel, not for this page.

Use the free retention schedule

The free data retention schedule is a spreadsheet (.xlsx, with CSV and Markdown downloads) with 16 starter record types and 10 columns, and a separate disposal log with 9 columns. The columns are:

Record type / data category; Example systems; Classification; Owner; Retention period; Trigger; Legal / contractual basis; Disposal method; Evidence of disposal; Review date.

It does not decide anything for you. The retention period is left as "[set by owner]", with the Policyseed policy's period shown next to it as an example where the policy names one, and the legal or contractual basis is always "[confirm with counsel]". Fill in your owners, systems and periods, set the lifecycle rules to match, and keep the disposal log as you go. The policy then says the Security Owner samples the schedule each quarter and reviews it at each policy review.

The generator writes the policy from your cloud, backup, logging and device answers. The Audit Kit ($59, one time) tailors the policy statements and procedures to your intake and adds drafts such as the policy exception register. It does not configure your lifecycle rules, delete anything, or give legal advice, and the CPA firm still decides whether the evidence is enough. Where a system cannot follow the schedule as written, use the policy exception register rather than leaving the policy untrue. To see where retention sits among your other gaps, take the free readiness assessment.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.