Base retirement on deal status, policy and law
Drafts should not persist indefinitely, but deletion must respect applicable financing law, claims, investigations, litigation holds and organizational retention schedules. Deleting an item from a vault is not proof of media sanitization.
After the financing round closes or diligence ends, Startup Operations inventories working drafts, underwriting exports, backups and investor copies. The records owner checks holds and the retention schedule, transfers the final record, and approves deletion or continued retention for each copy class.
Run the control in five steps
- 01Inventory draft, underwriting, submitted, backup and recipient copies.
- 02Check applicable retention schedules, claims and holds.
- 03Confirm the final system-of-record transfer.
- 04Assign keep, delete or sanitize disposition by copy class.
- 05Record verification, exceptions and accountable approval.
Preserve an accountable decision trail
Keep cycle, deal ID, copy class, location, authority, hold check, final-record transfer, disposition method, date, operator, verification, exception and approver.
Stop and investigate when
- Finalization triggers automatic deletion without a hold check.
- Vault deletion is called guaranteed sanitization.
- Investor downloads and backups are missing from the inventory.
State what the control does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate investor authorization, provider permissions, plaintext copies, retention and recovery separately.
Startup due diligence security questions
How long must financing records be retained?
Requirements vary by jurisdiction and circumstance; follow the organization’s approved schedule and legal guidance.
Is ordinary file deletion secure erasure?
Not necessarily. Use an approved method appropriate to the storage media and risk.
Sources for this decision
Links support specific control decisions and do not imply endorsement.