How Long Should a Testing Firm Keep Client Findings?

A testing firm should keep client findings on four clocks, not one: financial records for as long as UK rules require, the report for two to three years or as agreed, raw evidence for twelve to twenty-four months unless a retest is expected, and testing credentials not at all once the engagement ends. Ask most firms the question, though, and the honest answer is "we have never deleted any", not from negligence but because nothing forces the decision.

Storage is cheap, deletion is irreversible, and there is always a reason something might be needed later. That default is becoming difficult to defend. Clients ask about retention in supplier assessments, insurers ask in questionnaires, and the aggregate over several years is a remarkable concentration of other organisations’ weaknesses sitting in one place with no expiry.

What you are actually holding

Worth enumerating, because "reports" undersells it considerably.

• Findings, including ones the client never remediated.
• Screenshots showing live systems, sometimes with real data visible.
• Reproduction steps that work, or worked recently.
• Access credentials the client issued for testing, which are occasionally still valid years later.
• Network diagrams, asset inventories and scoping documents.
• Correspondence naming individuals on both sides.

A five-year archive across forty clients is a genuinely attractive target, and it is one you assembled by not making a decision.

What the obligations actually say

Less than people assume, and in different directions depending on the material. This is not legal advice: have a solicitor check the periods you put in your own terms.

Material	What drives the period	Typical defensible answer
Financial records of the engagement	Company and tax rules, which are specific	Six years from the end of the financial year they relate to, longer in some cases
The report and attestation	Client need and contractual terms	Two to three years, often longer by agreement
Evidence and screenshots	Data minimisation, and your own risk	Twelve to twenty-four months, unless a retest is expected
Testing credentials	Nothing justifies keeping these	Destroyed at the end of the engagement
Personal data within evidence	UK GDPR storage limitation: no longer than necessary, with no fixed period	Redacted at capture, so the question rarely arises

The pattern is that the deliverable and the evidence behind it have different half-lives. Most firms keep them together and apply the longest period to everything, which is the expensive choice in both storage and risk. The data protection side is covered in more depth in UK GDPR for penetration testing firms.

Setting a position you can defend

1. Split the categories. Financial, deliverable, evidence, credentials. Four periods, not one.
2. Write the periods down with the reason attached. A period without a rationale gets argued with; a period with one rarely does.
3. Put it in the engagement letter. Retention agreed up front is a selling point. Retention raised later is a negotiation.
4. Redact at capture. The cheapest way to answer a question about personal data in evidence is not to have captured it.
5. Handle credentials on the end date. Confirm revocation with the client, in writing, as part of closing the engagement, as described in handling evidence and client credentials safely.
6. Diarise the deletions. A policy nobody executes is worse than no policy, because you have now documented what you failed to do.

A retention policy you do not execute is a written record of a control you do not operate.

The archive you already have

A new policy does nothing about the five years already sitting on a file server, and that archive is where the risk is concentrated. Deal with it once, deliberately, rather than letting the policy apply only to work that starts next month.

• Credentials first. Search the archive for anything that looks like a password, key or token, and destroy it. Where it might still be live, tell the client it was retained and ask them to confirm it is revoked.
• Evidence by age. Anything older than your new evidence period goes, unless a dispute or a retest is open on it.
• Reports by agreement. Keep these under the new report period, and check the old engagement letters for anything you promised.
• Record what you did. A dated note of what was deleted, by whom, against which rule, is what turns a clean-up into evidence of a control.

The question that follows immediately

Clients who ask about retention almost always ask a second question: can you delete our data if we ask? It is worth knowing your own answer before it is put to you, and it belongs in the same document you use for answering a security questionnaire about your pentest platform.

The answer depends less on policy than on where the data physically is. If findings live in a platform somebody else administers, deletion means asking a vendor and trusting the confirmation. If they live in a database in your own cloud account, deletion is something you perform and can evidence. Either way, say what happens to backups: they roll off on their own schedule, and a precise answer that names it reads far better than a promise of immediate erasure everywhere.

A position worth publishing

• Four categories with four periods, each with a stated reason.
• Testing credentials destroyed at the end of the engagement, confirmed with the client.
• Evidence redacted at capture rather than reviewed later.
• Deletion scheduled and actually performed, with a record.
• A one-paragraph answer to "can you delete our data" that describes a mechanism.

Firms that get here find the same thing: it stops being a compliance chore and becomes something to say in a pitch. Being able to tell a prospect exactly how long you will hold their weaknesses, and what happens at the end, is a better answer than most of their existing suppliers can give.