Sense with Cents

Compliance can sound intimidating. The actual rule is simpler than most people expect, and it has not really changed in decades. Payroll and accounting data should remain in the United States. Your first line of data retention — the paper copies — should live in the same state where you do business. The state shown on your paystubs. The state shown on your tax returns. The state your business calls home.

That sounds obvious until you look at how often it isn’t true. Cloud services hosting employee data on servers in another country. Devices that travel with their users, client records living on them in the clear. Backup services that may or may not be able to tell you where the bytes actually live. None of this is illegal in most cases, but it adds risk and complication that almost no small business owner signed up for.

The cleanest first-line answer is the boring one. Paper records. In the same state where you do business. At the address you have already given the IRS on your filings.

WHY THE STATE MATTERS

State payroll obligations are tied to the state where the work happens and where the business is registered. Your unemployment insurance account is with that state. Your wage withholding is filed with that state. If a state agency has questions about your records, they reach out to the address you registered with them. It is a lot easier to respond when the records are sitting in the same building as the person who has to answer.

For most small businesses, that means a file cabinet in the office. Or a banker’s box on a closet shelf. Nothing fancy. The point is that the records are findable, in your control, and physically located where your business operates.

WHY THE COUNTRY MATTERS

Federal recordkeeping rules assume your records are accessible to US tax agencies. I have written separately about the IRS rules on electronic record retention, including the requirement that records be “kept available at all times for inspection” on the agency’s authority alone. The mechanics of those rules matter less here than the spirit: the IRS and state agencies expect to be able to inspect your records on reasonable notice. Records that physically live overseas, or on servers controlled by overseas providers, can complicate that expectation in ways the small business owner usually does not realize until something goes wrong.

Keeping the data in the US keeps the answer simple. If a tax agency asks where your records are, you can answer in one sentence.

WHAT ABOUT REMOTE EMPLOYEES

An employee who works from another state still gets payroll runs that are tied to your business’s state of registration and to the state where the work is performed. The records of those payroll runs live with the employer, at the employer’s state of registration — not with the employee, and not in the employee’s state. No employee is remote from a payroll perspective. They are working from somewhere, and that somewhere has tax implications, but the records of their pay live where the business lives.

WHAT ABOUT BACKUPS

A real backup strategy already covers the digital copies of your records. If you have read my piece on whether your backup is actually usable, you know the principles — more than one copy, in more than one place, current, and tested.

For your business’s digital backups specifically, the same logic applies as for paper. Keep the digital backup somewhere you control, somewhere in the US, ideally somewhere you can find it quickly when you need it. We chose to keep Medlin’s online backup service inside the US, with the same intent we are recommending here. Our backup provider guarantees US-based storage, with their main server in Oregon and mirrors in other areas of the Western US. Customer backups are encrypted, password-protected, and accessible only with your customer ID and your password. We can see how many backups you have stored. We cannot read them. That is by design.

Your paper records, your local digital backup, and your offsite digital backup form the three layers. All three should be in the United States. All three should be accessible to you on demand.

WHAT I DO MYSELF

When I am away from my office, I use remote access software to safely reach my office computer and data. My payroll and accounting data never leaves the state, and never leaves my office in an unencrypted form. I have no worries about my data being lost if my travel device “walks away.” And if a tax agency were to show up at my office door, there are paper records sitting right there for compliance.

My program code is a different category. That travels with me, backed up in about a dozen ways. The travel device itself stays secure when it is not actively in use, which is easier than most people think — ask me if you want the details. The point is that the data category drives the storage choice, not the other way around.

THE SIMPLE ANSWER

If a state agency, or the IRS, or your accountant, asks where your payroll records are, you should be able to answer in one breath: in a labeled box, in my office, in the same state where my business is registered. Anything more complicated than that is a sign your recordkeeping has drifted in a direction that may not serve you well at audit time.

Keep it simple. Keep it close. Keep it on paper, in your state, in your country.

See also: To Print or Not to Print, There Is NO Question! and Do You Really Have a Backup?