Updated October 2026
How to dispose of old business records (and what to ask before you shred)
Getting rid of old business records is often the last chore of a closure: archive boxes in a storage unit, an old server under a desk, a shared drive nobody pays for. Don't shred yet. Two questions come first. Does anyone still need the records? The IRS says an insurance company or creditors may need them kept longer than it does. And is any of it worth licensing before it goes?1
Step one
Check who still needs the old files
The IRS advises checking, before records are discarded, whether another party needs them, and names insurers and creditors as examples. Its own periods start at 3 years in general and run to indefinitely when no return, or a fraudulent one, was filed.1,2
Keep a short disposal log: what was kept, what was destroyed, on what date, and who agreed. If a creditor, an insurer or an asset buyer asks later, the log answers the question in a minute instead of a week.
Step two
Set aside the files a data buyer would want
Paper invoices and bank statements rarely interest an AI data buyer. The digital workspace usually does. SimpleClosure says Slack turned up in 95% of the closing companies' workspaces it evaluated, Google Drive in 87% and GitHub in 82%. For most small and mid-sized companies, that is where the working record lives.3
Not every category can be offered. SimpleClosure, for one, keeps sensitive employee and health records out of what it licenses, and takes code, chat, email and documents. Flag the excluded categories before anything is copied, sampled or destroyed, so they are handled on their own track.4
| Fact | Value and source |
|---|---|
| Tools in closing companies' workspaces | Slack in 95% of workspaces SimpleClosure evaluated, Google Drive in 87%, GitHub in 82% |
| What SimpleClosure leaves out | Sensitive employee and health records are excluded; code, Slack, email and docs are in scope |
Old servers and accounts
Digital records can disappear without anyone shredding them
An old server gets wiped because someone decides to wipe it. A cloud workspace can go by default. aitrainer.work says Slack, Google Workspace and GitHub organizations get deleted after non-payment, and suggests asking support whether a lapsed workspace can be restored.5
Our reading: if any part of the archive might be licensed, keep the billing running and the admin logins in safe hands until a buyer has seen a sample. Destruction can happen next month. It cannot be reversed once it has happened.
The same applies to hardware. Before an old server or laptop fleet goes to a recycler, find out whether it holds the only copy of a mailbox, a file share or a code repository. If it does, copy it first or hold the machine until a buyer has looked.
The method
How to destroy records is a question we route, not answer
Owners often ask what disposal method is required for records that contain personal information, such as cross-cut shredding or certified data wiping. We do not say which rules apply to a given business or what method meets them. Put the question to the licensing company and to whoever handles the dissolution, and keep their written answer with the disposal log.
FAQ
Questions, answered with sources
Whether anyone else needs them. The IRS names an insurance company or creditors as parties that may require records to be kept longer than the IRS does.1
3 years in general; 6 years if unreported income is more than 25% of the gross income shown; 7 years for a worthless securities or bad debt claim; indefinitely if no return or a fraudulent return was filed.2
Mostly the digital workspace. SimpleClosure says it found Slack in 95% of the closing companies' workspaces it evaluated, Google Drive in 87% and GitHub in 82%.3
SimpleClosure leaves out sensitive employee and health records. Workspace material such as code, Slack threads, email and documents is what it handles.4
aitrainer.work says Slack, Google Workspace and GitHub organizations get deleted after non-payment. It suggests paying until a buyer has sampled the data.5
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
Before you sign
Legal questions go to the licensing company
We do not answer legal questions. Ask the licensing company before you sign: their team reviews these with you.
Questions for this kind of business
- Does the FTC Disposal Rule, or a state records-disposal law, cover any of the records we plan to destroy?
- If a copy of the workspace is licensed, who destroys the buyer's copy at the end of the term, and how is that confirmed to us?
- Do former employees' files need different handling from customer and vendor records before disposal?
- Who owns this data: the company, an estate, or someone else?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
- How are employee data, union contracts and NLRA questions handled?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?