Data Retention Overview

Version 1.0.0 · In effect from 7 August 2026

How long each type of record is kept, why, and what happens to it when an operator closes its account. Compliance evidence is not deleted merely because a generic period has expired.

1. How retention is decided

A sign-in log, a brake test record and an audit entry age out for entirely different reasons, so a single retention period would be wrong for all three. Every record type in the platform is assigned to one of five bases:

Operational — useful while it is live. Deleted when it is no longer needed, and on account closure.
Statutory / compliance evidence — kept because law, DVSA guidance or the defence of legal claims expects it. Never removed by a generic sweep, and survives account closure.
Security record — kept so that account misuse can be investigated. Never visible to another operator.
Audit trail — evidences who did what. Append-only, and not editable by anyone, including the operator's own administrators.
Operator configurable — the operator chooses, within a floor set by statutory expectations. An operator can lengthen these periods; it cannot shorten them below the floor.

2. The retention matrix

Version 1.0.0
Area	Records	Retention	Basis	On account closure
Accounts and profiles	Name, work email, job title, phone, sign-in identity	Life of the account; personal details erased at closure	Operational	Deleted
Memberships and roles	Which person held which role in which operator, and when	6 years from the end of the membership	Audit trail	Retained
Invitations	Invited email address, role offered, token state	12 months from issue or acceptance	Operational	Deleted
Vehicles and trailers	Registration, identity, weights, ownership, operating centre history	Life of the asset in the fleet, then 2 years	Statutory / compliance evidence	Retained
Driver walkaround checks	Check answers, defects reported, photos, declarations, nil defect records	15 months minimum	Statutory / compliance evidence	Retained
Defects and rectification	Defect reports, severity, VOR decisions, rectification and sign-off	15 months minimum, and while the asset remains in the fleet	Statutory / compliance evidence	Retained
Maintenance and PMI records	Inspection records, brake tests, roller test results, policy in force at the time	15 months minimum; 2 years recommended	Statutory / compliance evidence	Retained
Workshop job cards	Jobs, labour, parts, costs, estimates, external provider work	6 years	Statutory / compliance evidence	Retained
Technician records	Work sessions, timers, repair records, rework attempts	6 years	Audit trail	Anonymised
Declarations and quality control	Mechanic declarations, QC reviews, return-to-service decisions	6 years	Statutory / compliance evidence	Retained
Documents and uploaded evidence	MOT, insurance, plating, finance documents, photographs	Life of the asset plus 2 years, or the document's own expiry plus 15 months, whichever is longer	Statutory / compliance evidence	Retained
Audit log	Every change: who, when, old value, new value, reason	6 years	Audit trail	Retained
Alerts	Expiry and compliance alerts, their status and resolution	24 months	Operational	Deleted
Notification history	Reminder runs, deliveries, recipient address, delivery outcome	13 months	Operational	Deleted
Evidence packs	Generated DVSA / public inquiry packs, manifests and checksums	6 years	Statutory / compliance evidence	Retained
Offline sync ledger	Queued operations, conflicts, device sync state, on-device copies	90 days server-side; on-device data cleared on sign-out	Operational	Deleted
Security and sign-in records	Sign-in successes and failures, lockouts, MFA events, trusted devices, IP and user agent	12 months	Security record	Retained
Legal acceptances	Terms and privacy versions accepted, by whom, when and from where	6 years from the end of the contract	Audit trail	Retained
Data exports and closure requests	Who exported what and when; closure requests, cancellations and completion	6 years	Audit trail	Retained

3. Notes on individual areas

Area	Note
Accounts and profiles	On closure the profile is stripped of email, phone and photo and the person can no longer sign in to that operator. The name recorded against a completed inspection, repair or sign-off is not deleted with the profile — it is retained inside that compliance record so the evidence stays attributable. Someone who also works for another operator keeps their profile for that operator.
Memberships and roles	A person leaving an operator has their membership ended, not erased. Ending access immediately removes their ability to see data while preserving who was authorised at the time of a historic record.
Invitations	Unaccepted invitations expire and their tokens are unusable long before this point.
Vehicles and trailers	Underpins maintenance history; DVSA expects records for the period an asset was operated.
Driver walkaround checks	DVSA Guide to Maintaining Roadworthiness expects daily walkaround records to be kept for at least 15 months. Operators may configure a longer period; they cannot configure a shorter one.
Defects and rectification	Safety-critical evidence. Never removed by a generic retention sweep.
Maintenance and PMI records	The maintenance policy version applied at the time is preserved with the record.
Workshop job cards	Aligns with the ordinary UK limitation period and with tax record-keeping for cost lines.
Technician records	The work is retained; the individual technician is reduced to a role and an internal reference where the person has left and no live investigation applies.
Declarations and quality control	Immutable once signed. These records evidence who authorised a vehicle back into service.
Documents and uploaded evidence	Stored in access-controlled object storage; only reachable through short-lived signed links.
Audit log	Append-only. Operators cannot edit or delete audit events, and neither can their administrators.
Alerts	The underlying compliance record the alert pointed at is retained under its own rule.
Notification history	Message bodies are kept deliberately minimal and never restate driver or defect detail.
Evidence packs	A pack produced for an inquiry is itself evidence and is not removed on closure.
Offline sync ledger	The offline queue holds work in transit only. Confirmed work lives in the records above.
Security and sign-in records	Needed to investigate account misuse. Not visible to other operators under any circumstances.
Legal acceptances	Evidence of contract formation. Permanently immutable at database level.
Data exports and closure requests	Records the exercise of data rights, which must itself be demonstrable.

4. Account closure

Closing an operator account is a controlled workflow, not a button. An authorised administrator requests closure, sees an impact summary of exactly what exists, confirms deliberately, and the account then enters a 30-day pending state during which it can be cancelled and a full export can still be taken. At the end of that period operational data is deleted, technician-level records are anonymised where the individual has left, and statutory, audit and security records are retained for the periods in the matrix above.

5. People who leave an operator

A person leaving is handled by ending their membership. Access stops immediately. Their completed inspections, repairs, declarations and sign-offs remain attributable, because a compliance record that cannot say who carried out the work is not evidence. Where a genuine erasure request is made and no statutory or audit basis requires the name, the individual is reduced to a role and internal reference in the historical record.

6. Questions

Retention questions, legal holds and erasure requests: privacy@fleetverified.co.uk. Operators can see this same matrix inside the product, alongside their own configured periods.