Document archiving: the paper you cannot find

An archive fails at the search, not at the storage. The document exists, somebody filed it, and nobody can produce it in the ten minutes a customer, a bank or an inspector is waiting — so the quality of an archive is measured by the time to produce a document, not by the number of boxes. Three things shorten that time: an index built for the question that actually gets asked, a retention period beside each document type, and an access rule saying who may look.

What does an archive need besides a shelf?

Four elements, and the shelf is the least interesting of them. An index recording what the document is, when, with whom and under which reference. A location the index points to — a box number, a folder, a file — so that the index answers without a search. A retention period per type, with its reason beside it. And an access rule deciding who may open which type.

An archive with three of the four is a cupboard with opinions.

What should the index be built on?

On the references the documents already carry, plus the four facts every question uses: type, date, counterparty, reference. Type and reference come from the document itself — an invoice number, a contract number, a delivery note. Date and counterparty come from the same page. Nothing needs inventing, and every invented field is a field each person will fill in differently.

The test of an index is a sentence: "produce the delivery note for this invoice", "produce everything we signed with this supplier". If it cannot answer those, the archive will be searched by hand for as long as it exists.

How long do you keep a document?

For as long as the longest obligation touching it. Three clocks apply: the commercial one, while a dispute remains possible; the fiscal one, as the tax rules require; and the operational one — warranty, contract term, product life.

Your accountant and your counsel set those periods, not us. What the system owes them is a period per type, its source, and a way to see which documents have passed it. A habit — "we keep everything 7 years" — is not a rule: it either destroys evidence early or keeps personal data too long.

What the index holds	Why it is there	What breaks without it
Type and reference	The document can be named before it is found	A search by date across a year of paper
Date	Retention, and the answer to "when"	Nothing ever falls due for destruction
Counterparty	The question is almost always about a party	Filed by supplier, asked by contract
Location	The index points rather than guesses	Every request becomes a physical search
Batch or case file	A complaint or an audit needs the run	The wrong document is produced, confidently

Who may look, and who logs the look?

Access by role and by document type, not by cupboard key. The person answering a customer needs that customer's invoices and delivery notes; nobody needs the payroll archive. Grant the narrow set, and revoke when the role changes — the archive outlives the job.

Log the opens. An archive holds personal data and commercial terms, and after an incident the first question is who saw what. A shared account answers "the accounts login opened it", naming nobody.

What should be destroyed, and how?

As a scheduled act with a record: a list, an approval, a method and a date. Not "the cleaner took the boxes", and not a shredder used by whoever needs the space.

Digital destruction has more surfaces than people expect: the file, the folder copy, the export somebody made for a meeting, the scanner's cache, and the backup, where a copy lives as long as the backup is kept. Destroy the document and leave the copy, and the destruction is a formality.

One exception belongs in the schedule: nothing under a hold is destroyed. A dispute, an audit, a claim — the clock stops, and the list gets checked against open cases before anything leaves.

What makes a digital archive findable in three years?

The index, not the file names — but naming still matters, because people search folders when the index is slow. Type, date, counterparty, reference, in that order, and one folder tree that mirrors the index rather than a second taxonomy invented by whoever was tidying up.

Formats should be readable without the application that produced them, and identifiers should survive a migration of the system that issued them — the demand for durable identifiers that the W3C sets out for published data.

How do you start with the boxes you already have?

Triage rather than digitise everything. Three piles: must keep and must find soon, which get indexed and scanned; must keep and rarely asked for, which stay in a box with a list taped to the lid; and past its period, destroyed with a record. Start from the documents somebody actually asked for last year — that list is your priority order, and it is shorter than the shelf.

The order to do this in

1. List the document types you issue and receive, and who asks for each one.
2. Write the retention period beside each type with its source, confirmed by whoever owns the obligation.
3. Fix the reference for each type, and the index fields that answer the questions you actually receive.
4. Choose one location per type — box, folder, system — and record the pointer in the index.
5. Write the access rule by role, then create the accounts that match it.
6. Turn on the open log, and read it once a month until it is boring.
7. Put destruction on a calendar with an approval line, a method per medium, and a check against open cases.
8. Triage the backlog by what was requested last year, not by what is oldest.

Where this goes wrong

• Two indexes. A spreadsheet and a folder tree that drift apart within a quarter, and neither is trusted afterwards.
• The scan stops at the signature page. The document proving delivery is the one with the stamp on the back.
• Destruction by whoever needs the space. The cheapest decision in the building and the most expensive to defend.
• The archive is the only copy. No backup, or a backup never restored, which is the same thing.

What this does not cover

Nothing here is legal advice, and no retention period in this piece should be read as one: the periods come from your obligations, stated by the people who own them. It is not a records-management standard or a certification either. It does not cover email retention at scale, system logs, or the physical conditions of a store — humidity, pests, a leaking roof — which damage more archives than filing does. And an index is not a backup: an archive can be complete and still lost.

We build the archive as data: a reference on every document, an index that answers the question being asked, an access rule that records who looked, and a destruction step with a name on it.