HMRC requires you to keep business records for at least 5 years after the 31 January submission deadline for the tax year they cover — practically about 6 years. The 6-Year HMRC Vault stores everything so you stay compliant without lifting a finger.
What we keep
- Receipt images — every photo or PDF you uploaded through the scanner.
- OCR'd data — the structured fields (vendor, date, amount, VAT, category) extracted from each receipt.
- Invoices — every invoice you issued, as the PDF you sent + the structured DB row.
- HMRC submissions — every VAT return, MTD ITSA update, FPS, CIS300 payload plus the IRmark receipt.
- Audit trail — every meaningful action (who, when, what changed) so you can reconstruct any decision.
How it's stored
- AES-256 encryption at rest.
- Vercel Blob with random-suffix URLs so files aren't guessable.
- Neon Postgres with daily backups.
- TLS 1.3 for everything in transit.
Retention
Everything is kept for the full HMRC-mandated period — 6 years from the end of the tax year the document relates to. Even if you close your account, we keep the data marked-for-deletion until the statutory period expires, then it's purged.
Downloading your records
Settings → Data → Export all data kicks off an async export job. You'll get a ZIP containing every receipt image, every invoice PDF, every HMRC submission XML, and a JSON/CSV dump of every record on your account.
For HMRC enquiries
If HMRC ever asks for records, the export gives them everything they could possibly ask for, in their preferred order. You can also share a single receipt directly from the Expenses detail page — there's a "share read-only link" option that gives a 7-day token.