How long documents are kept, and what erasing one removes

Understand how long the system keeps HR documents, what the two kinds of erasure remove, and what every erasure leaves behind.

Before you start

You need a role that manages documents (HR or Admin).
Open Documents from the main navigation and select the folder the document is in. On a phone the navigation is in the More drawer.
Erasing is done on the screen; retention periods are not. You can erase a document yourself, from its card in the library. Retention periods are still set on your behalf by your administrator, and the due-list runs as a nightly check — so the part of this article about how long a document is kept describes something you ask for rather than something you set.

How long a document is kept

A retention period is set on a folder, in whole years, and it applies to every document in that folder.

A folder without its own period follows the nearest folder above it that has one. So a period set on Payroll covers Payroll → 2026 → Q1, unless one of those states a different period of its own.
A folder with no period anywhere above it has no retention rule. Its documents are kept until somebody decides otherwise. That is not the same as a period of zero — there is no way to say “erase immediately”.
The clock runs from the day the document’s latest version was published, not from the day the document was created. Publishing a new version restarts it, because what is being kept is the current content.

What happens when a period runs out

Nothing is deleted automatically. A nightly check produces a list of documents that are now due, and somebody reads it and decides.

This is deliberate. Erasing a document is irreversible, one of the two kinds of erasure destroys evidence permanently, and neither is a decision a nightly job should take on somebody’s behalf.

Erasing a document, step by step

Find the document in the library and press Erase this document…
Read the two choices below and pick one. Neither is selected for you, on purpose: one keeps your proof that people accepted the document and the other destroys it, and “erase this document” does not choose between them. Erase permanently stays greyed out until you have chosen.
Press Erase permanently. The document disappears from the library.

There is no second “are you sure?” step. The choice you just made is the confirmation, and a second dialog would only teach people to click through it.

If some files are left behind

Occasionally you will see The document is erased and cannot be recovered. Some of its stored files are still in storage.

Read that literally: the document is gone. It is not a failure and there is nothing to undo. What happened is that the document and all its records were removed, and the file storage did not manage to delete every file. You can leave the screen and come back — the document will not reappear.

There is no button for this on the screen yet. The message tells you where the leftover files are recorded: their locations are kept with the erasure record, and the removal can be completed from there — ask for it and it will be done. Nothing about the document comes back in the meantime, and the files are not readable by anyone in the product while they wait.

This is different from “This document could not be erased because its storage could not be reached. Nothing has been changed.” That one means exactly what it says: the erasure did not happen, the document is still there, and you can try again when storage is back.

Every erasure says what happens to the evidence

There are two kinds of erasure, and every request has to say which one it is. There is no default, on purpose: one of them keeps your proof that people accepted a document and the other destroys it for good, and “erase this document” does not choose between them.

Both kinds remove the same things:

the stored file, for every version of the document;
the record of the virus scan on each file;
who the document was assigned to, for everyone it was assigned to;
the document itself, which disappears from the library.

Nobody can open the document afterwards, and the file cannot be recovered. An erasure is permanent.

Keep the acceptance record — ask for this when a document has simply reached the end of its retention period. The version history and the record of who accepted which version stay in the system. The old staff handbook stops being available, and you can still show that a named person accepted version 3 of it on a date.

Erase the acceptance record as well — ask for this when somebody exercises their right to have their personal data erased and the acceptance record is part of what they are asking about. The version history, the record of who accepted which version, the record of who opened it and the document’s own activity trail all go with the document.

The second kind cannot be undone and cannot be partially undone. After it, nothing in the system can tell you that a particular person accepted that document — because that is precisely what was asked for.

The activity trail records how many files were actually deleted. If it also says that some were already gone from storage, that is a statement of fact and not an error: a file can have been removed earlier, by an administrator or by a previous erasure, while the record of the version that pointed at it stayed. The trail says so rather than counting a file nobody deleted.

What every erasure leaves behind: the erasure record

Both kinds of erasure write one record that says what was erased. It holds the document’s title, the folder it was in, which of the two kinds was used, how many files, versions, acceptances and assignments were removed, and when and by whom. Nothing can change or delete that record afterwards — not an administrator, not another erasure.

That record is how you answer “what happened to that document?” after the document is gone, and how you show that a request to erase somebody’s data was actually carried out.

It does not name the people whose records were erased. It counts them. A record that repeated the names would put back exactly what the erasure took away.

It does name the DOCUMENT — so mind what you put in a title. The title is kept, because a record whose subject nobody can identify is not much of a record. That means a document called “Disciplinary letter — Anna Kowalska” leaves that name behind in the erasure record even after the strongest erasure. If a document’s title would name a person you may later be asked to erase, put the name inside the document and keep the title general.

What this means in practice: when an employee asks you to erase their personal data, choose Erase the acceptance record as well. When a document has simply reached the end of its retention period, choose Keep the acceptance record.

What you cannot undo

An erased file is gone. There is no recycle bin and no restore.
A document you erased does not come back, even if some of its files were left in storage — see If some files are left behind above.
An acceptance record erased by the second kind is gone too, and no backup restore will bring back just that — restoring a backup brings back everything, including what somebody asked you to erase.
The erasure record itself cannot be edited or deleted by anyone.
A retention period can be changed or removed at any time, and changing it changes only which documents appear on the due list from then on. It never erases anything by itself.