Records

Keeping business records in the cloud: what to check before you move them.

Most American businesses already keep much of their records online, often without a deliberate decision. Accounting lives in one service, contracts in another, payroll in a third, and scanned receipts wherever the phone app put them. That convenience is real. So is the risk that, when a record is needed, nobody can say where it is or prove it has not been changed.

This article sets out what to check before you rely on cloud services for records you are required, or simply wise, to keep. It is general information. Ask your CPA or attorney about the specific requirements that apply to your business and industry.

What the IRS expects of electronic records

The IRS allows businesses to keep records electronically and has published guidance on it. Revenue Procedure 97-22 addresses electronic storage systems, including systems that image paper records, and Revenue Procedure 98-25 addresses records kept in machine-sensible form, such as accounting system data.

In broad terms, that guidance looks for records that are accurate and complete, kept in a way that lets them be retrieved and read, and protected against unauthorized changes. It also expects you to be able to produce legible copies when asked. If you intend to scan paper and discard the originals, read the guidance with your tax professional first, because the details matter.

Retention periods depend on the record and the situation. Our companion article on how long to keep business records summarizes the general periods the IRS describes.

Five questions for every service that holds records

1. Who can get in?

List every person with access, including former employees and outside bookkeepers. Check whether sign-in requires two-step verification and whether you can see when someone last used their access. Shared logins are common in small businesses and make it impossible to say who did what.

2. Can a record be changed without anyone knowing?

Look for version history and an activity log. A service that lets anyone overwrite a file silently is a weak place to keep a record you may need to show in its original form.

3. Where is it kept, and who else handles it?

Ask the vendor where data is held and which subprocessors are involved, and keep the answer in writing. Some contracts with customers or lenders, and some industry rules, care about this, and state privacy laws can bear on how personal information is handled.

4. How do I get everything out?

Check what an export looks like before you need one. A bulk export that flattens folders into thousands of loose files, or omits attachments, can turn a routine request into a week of work. Know what happens to your data if you stop paying or the vendor closes.

5. What is backed up, and by whom?

Many services protect against their own hardware failures but not against your mistakes. If someone deletes a folder, how long can it be recovered? Is there a recycle bin, and who can empty it?

Habits that keep records usable

Agree on one home for each category of record, and write it down.
Use folder names and file names that will still make sense to someone else in five years.
Scan paper at good resolution so text can be read and searched.
Remove access promptly when staff or contractors leave.
Review once a year: what was kept, what can be disposed of, what has moved.

None of these needs special software. They do need someone to own them, which in a small business often means the owner or an office manager working with the outside CPA.

Sharing records is a separate decision

Keeping records and sharing them are different jobs. The place you archive payroll does not have to be the place you show it to a buyer, a lender or an examiner, and often should not be. Sharing directly out of an archive can expose much more than the recipient needs.

A data room is built for the sharing part. In ShareAndGo, you copy in the folders a recipient needs and keep their structure. Each recipient confirms their email address with a six-digit code. Groups limit which folders each audience can see, and download, print and copy can be switched off. View-only PDFs, Word, Excel and PowerPoint files are rendered on our side with the viewer's name, email address and date, and the original is not sent to their browser.

Version history keeps earlier copies when a revised file arrives. The audit log records every view, upload, download and change, chained so that alterations are detectable, and exports as CSV. Deleted files go to a recycle bin, and emptying it removes the stored files and their previews. When the job is done, the room can be exported as a ZIP with its folders and an index of every document.

If you need to say where ShareAndGo keeps documents: Your documents are stored in the United States. Some services run elsewhere, and our privacy policy lists them.

Common questions

Is cloud storage acceptable to the IRS?

The IRS accepts electronic records in many circumstances, subject to its published guidance. Ask your tax professional whether your setup meets it.

Should our data room be our archive?

Usually not. Use your archive for keeping records and a room for sharing a defined set of them with a particular audience for a particular purpose.

What about records with Social Security numbers?

Limit who can see them, share only when needed, and consider redacting before sharing. Our article on protecting SSNs and EINs covers this.