The periods vary by what the record is and why somebody might ask for it. The general federal position is three years from the filing date for most returns, extending to six where income was substantially understated, and there is no limit at all where a return was never filed or was fraudulent. That range is why seven is the common conservative answer rather than three.
Some records outlive the general rule by a long margin. Anything establishing the cost basis of an asset needs keeping until several years after you dispose of it, which for equipment or property can be a decade or more. Employment tax records have their own minimum. And documents recording the formation of the business, its structure, and its ownership should be kept permanently rather than on a schedule.
The categories worth keeping indefinitely are shorter than people fear. Formation documents, the operating agreement, tax returns themselves, and anything recording ownership or a major transaction. Those occupy almost no space and their absence is genuinely difficult to remedy.
Digital storage changes the calculation entirely and most businesses have not updated their thinking. Scanning is generally acceptable provided the copies are complete, legible, and retrievable, which means the old argument about physical space no longer applies. Keeping everything is now cheaper than deciding what to discard, and the time spent choosing exceeds the cost of storage.
Organise by year and by category as you go, because retention is only useful if retrieval is possible. A folder per year containing bank statements, invoices issued, invoices received, tax filings, and payroll is sufficient structure, and it means a request for a specific year is a lookup rather than a search.
Keep the backup off the same machine, since a retention policy that depends on one laptop is not a policy. Cloud storage with version history, or a backup you have actually tested by restoring something, is the difference between having records and believing you have them.
Be careful about records containing personal information, which cut the other way. Customer data held indefinitely increases what is exposed if anything goes wrong, and several privacy regimes expect you to hold it only as long as there is a reason. That means financial records and customer databases have different logic: keep the first, and set a defined period for the second.
Then write down what you keep and for how long, in a few lines. Nobody enforces this at your scale and the document exists so that decisions are deliberate rather than accumulated, and so that anybody else in the business follows the same rule. This is general information rather than advice on your situation, and your accountant can confirm the periods that apply to your specific records.
Check whether the original is required or whether a scan suffices, since a small number of documents still carry weight in physical form. Signed contracts, anything notarised, and certain licences are worth retaining as originals alongside the digital copy, and the rest can be scanned and the paper discarded.
Name the files so a year can be located without opening anything. Year first, then the category, then a short description, means a request for a specific period is a matter of sorting rather than searching, and that structure costs nothing when applied from the start.