For each engagement, the records you uploaded and the outputs produced are kept for seven years from the end of the accounting period, at no extra charge. You can export or delete an engagement at any time. Keeping an engagement on AllDone beyond seven years is possible and is charged as archive storage under the terms, with notice before anything is charged and before anything is removed.

You can remove an uploaded file from its slot on the job's Files screen, and a partner or senior can archive a job. Deleting a file or a job is immediate and cannot be undone. The audit trail survives the records it describes, so the fact that a file was uploaded and removed remains on the record even though the file has gone.

The raw upload itself is never kept. It sits in a quarantined area only for as long as the upload request takes, is deleted straight after processing, and an automated rule at the storage layer clears anything left behind.

The published retention table is the authority. In outline: processed files, working papers and outputs live for the life of the engagement and the account, subject to the seven-year position in the terms; the audit trail is kept for six years, because that is what professional record keeping needs; application logs are kept for ninety days; database backups roll on a seven-day window and file backups on thirty days. AI telemetry records what a call cost and how long it took, never the text of a prompt.

Before your access ends, export what you need. AllDone provides an engagement file pack for each completed engagement, plus the working papers and every export in standard formats. Keeping your own copies of what you are professionally required to retain is the firm's responsibility, and the export functions exist for exactly that.

Once you confirm you have exported everything you must keep, client data is returned or deleted within thirty days of termination, and remaining copies are removed from backups within a further thirty days.

Offboarding is run deliberately, by a person, not by a button anyone can press: there is no route into the product that deletes a whole firm. The operator has to confirm the firm by name, and the tool refuses to run while a step is still running on any job.

It first disables the accounts so nothing can be reached while the deletion is under way, then removes every client and everything that hangs off them, including the map that translates reference codes back into real names, the firm's learned patterns and its stored wording, and the firm's entire file storage. The audit record of what was done is kept unless the agreed retention window has passed, in which case that goes too, leaving only a one-line internal record with no client information in it.