Matrix
Legal
Data retention
Last updated: September 2026
This document is a draft and is being reviewed. If you have a question about it,
contact us.
Australian businesses have to keep their records for set periods, and Matrix is built so you can. This page summarises the main legal obligations, then explains how long Matrix keeps each kind of information and what happens when you delete something or leave. It supplements our privacy policy.
General information, not legal or tax advice. Your obligations depend on your business's
structure and circumstances, and periods can be longer — for example, while a tax return is under review or
a dispute is open. Your accountant or the ATO can confirm what applies to you.
What the law requires you to keep
Keeping your records is your business's obligation. Matrix holds them for you, but the requirement to keep them — and to be able to produce them — rests with the business. The main Commonwealth rules are:
| Records | Generally kept for | Source |
|---|---|---|
| Income tax records — income, expenses, invoices, receipts, bank statements | 5 years from when they were prepared or obtained, or the transaction completed, whichever is later | Income Tax Assessment Act 1936, section 262A |
| GST records — tax invoices, adjustment notes, BAS workings | 5 years | Taxation Administration Act 1953, and the ATO's record-keeping rules |
| Records for assets, including capital gains | 5 years after the asset is sold or otherwise disposed of | Income Tax Assessment Act 1997 |
| Company financial records | 7 years after the transactions they cover | Corporations Act 2001, section 286 |
| Employee records — pay, hours, leave, superannuation contributions | 7 years | Fair Work Act 2009 and Fair Work Regulations 2009 |
| Superannuation guarantee records | 5 years | Superannuation Guarantee (Administration) Act 1992 |
| Fringe benefits tax records | 5 years | Fringe Benefits Tax Assessment Act 1986 |
Records must be kept in English, or in a form that can readily be converted to English, and be available to the ATO or another regulator if they ask. Keeping them electronically, as Matrix does, meets that requirement.
The Privacy Act 1988 works the other way for personal information: once it is no longer needed for any purpose it may be used for, and no law requires it to be kept, it must be destroyed or de-identified (Australian Privacy Principle 11.2). A retention rule is therefore a minimum for business records and a limit for personal information we hold for our own purposes.
How Matrix helps
- Posted records are never altered. A correction is a new entry linked to what it corrects, so the history an auditor or the ATO asks for is complete.
- Every financial change is audited — posting, voiding, reversing and locking periods — in the same transaction as the change itself.
- Your records can be exported at any time, as reports, spreadsheets and PDFs.
- Your records, and every backup of them, are stored in Australia. See data residency.
How long Matrix keeps your data
| Information | How long we keep it |
|---|---|
| Your business's records and files | While your account is open, and afterwards for at least as long as the law requires you to keep them |
| Financial, data-administration and security audit trails | Permanently, because they are the evidence of what happened to your records |
| Usage records — pages visited, the browser used, error reports | Kept, so we can investigate security incidents and find what is slow or broken. They are not currently deleted automatically |
| Messages you send us, including text messages | Kept, as our record of correspondence with you |
Deleting information, and leaving Matrix
- Before you leave, export what you need. After you close your account we keep your business's records for the period the law requires, so they can be produced if you or a regulator need them, and we restrict their use to that.
- Deleting something removes it from use straight away. A copy can remain in backups, which stay in Australia, until they are replaced in the normal course.
- Where you ask us to delete information the law requires us to keep, we keep only what is required, restrict its use, and delete it when the obligation ends.
- Records you have posted in your books cannot be deleted, only corrected or reversed — that is what makes them reliable records.
Questions
To ask about the records we hold for your business, or to request deletion of personal information, contact us.