Seven Years of Records on Someone Else's Server: Exit Planning for Australian Small Business Software

You are. Not Xero, not MYOB, not ServiceM8, not the vertical platform your industry runs on. The ATO's position is that a business must keep records that explain its transactions, generally for five years from when the record was prepared or the transaction completed (source: ato.gov.au, Record keeping for business). If you operate through a company, the Corporations Act 2001 (section 286) requires financial records to be retained for seven years. Neither obligation transfers to a vendor because you pay them monthly. The terms of service you clicked through almost certainly say the opposite: that the vendor may suspend, restrict or delete your account data in defined circumstances, and that you are responsible for maintaining your own copies. This is not a scandal. It is the normal shape of a SaaS contract. The problem is that the clause is easy to click past, and it is easy to assume the platform is the archive. It is not the archive. It is a working system that happens to hold the archive right now. A useful test: if your card declined this month and the account locked next week, could you produce five years of invoices, payroll records and reconciled bank data without logging in? If the answer is no, the platform is doing your record keeping for you, and only for as long as you keep paying.

It happens, and the pattern is recurring rather than universal. Owners describe waking up to a pricing or ownership change that gates access to data they had already paid to store. One example posted to r/AusLegal: “Woke up last week to find in the early hours of the morning, the company has attempted to charge us an additional $600 odd. Two hours later we received two emails advising of migration from Company A to Company B and that if we wished to retain access to the system, we would need to pay the additional funds.” Product changes can have the same effect without any bad intent. From r/ausbusiness: “If you're on MYOB AccountRight and updated to 2026.5, you can no longer save a backup of your own company file. Files are online only now. MYOB's official suggestion for the 7 year record keeping requirement is to keep an old version of the software installed so you can view old backups. Seriously.” Note what that second one really describes. On the poster's account, nothing was deleted. A local backup option went away, and with it the customer's compliance position shifted from holding a file to holding a login. Those are very different positions when a dispute, an audit or an outage arrives. You cannot control vendor roadmaps. You can control whether a roadmap change is an inconvenience or an emergency.

Treat it as a scheduled task, not a reaction. Once a year, ideally just after your accountant finalises the prior financial year, pull a fixed list into storage you own. General ledger and trial balance, kept as CSV plus PDF, so the accounts can be reconstructed without the platform. Sales and purchase invoices as PDF with a CSV index, to substantiate income and deductions. Bank transactions and reconciliation reports as CSV, to prove the ledger ties to real money. Payroll registers, payment summaries and super as PDF plus CSV, because Fair Work and ATO obligations outlast the software. BAS and tax lodgement copies as PDF for audit defence. Customer and supplier contact lists as CSV, since that is the asset you rebuild the business on. Job or project history from vertical tools as CSV plus attachments, for warranty and dispute evidence. Attachments and receipt images in their original files, because they are usually the first thing lost in a migration. A business owner taking over her own books, posting to r/Bookkeeping, described exactly this instinct while leaving a platform. The thread is a US one, so the obligations differ, but the sequencing does not: “I am currently downloading data from quick books so we have it on file in the event of an audit and so we can cancel this monthly subscription.” The ordering in that sentence is the point. Export first, cancel second. Doing it the other way around is how people end up on a one hour support call about data that no longer exists.

A format you control is one that opens without the vendor. That is a short list: CSV, PDF, plain text, standard image files, and open database dumps. It is not a proprietary company file that only opens in one version of one product, and it is not a link into a portal. Three practical rules. Store copies in at least two places you pay for separately from the software. Cloud storage plus a local drive is enough. If the same login controls both the software and the backup, you have one point of failure, not two. Keep the export self-describing. A folder named 2025-26 with subfolders for ledger, payroll, invoices and attachments beats a zip file called export_final_v3. Open one file from each export. An export you have never opened is a guess, not a backup. Restoring is a skill, and it is best practised on a quiet Tuesday.

Partly, and it is worth being honest about the limits. The trap is real. From r/ausbusiness: “Software discounts: I wouldn’t be inclined to chop and change my software as we know what we are doing with the software we have and bank accounts are linked etc I wouldn’t want the hassle of trying to do it all over again.” That is a rational position. Bank feeds, staff habits, integrations and years of history genuinely cost something to move. An annual export does not make migration free. What it does is separate two costs that owners tend to bundle together. There is the cost of rebuilding workflows in a new tool, which is real and unavoidable. And there is the cost of not being able to leave at all, which is the one vendors quietly rely on. Exit planning removes the second. The practical effect is negotiating position. An owner who holds a clean, current export can credibly say no to a price rise, take their time evaluating alternatives, and treat renewal as a decision rather than a default. An owner who holds only a login cannot. Counter-argument worth conceding: for a lot of businesses the incumbent tool is fine, and the export will sit unused for years. That is a success, not waste. It is the same logic as insurance, and it costs a few hours annually rather than a premium.

One named person, with a calendar reminder and a written checklist. Not the accountant, who works on your file but does not hold your obligations. Not whoever remembers. This is the same failure mode that kills internal automations. A process with no owner does not survive its first busy quarter. The person who owns the export should be the same sort of person you would trust to own an internal workflow: someone who can read a system, map what it actually does, and notice when the output stops matching reality. That capability is learnable, and it is more valuable than the export itself. An owner who understands where the data lives, which fields matter, and how the pieces connect is the same owner who can automate the boring parts of the business without hiring a retainer to do it. The skill is diagnosis and process-mapping. The export checklist is just the first place it pays off. Start smaller than feels satisfying. Pick the three record types that would hurt most to lose. Export them this week. Add the rest next quarter.

How long do Australian businesses have to keep records? The ATO generally requires business records to be kept for five years from when they were prepared or the transaction completed. Companies must retain financial records for seven years under section 286 of the Corporations Act 2001. Some records, such as those relating to capital assets, need to be kept longer. Is my accounting software provider responsible for my record keeping? No. Check your own vendor's terms, because they will usually put the responsibility for keeping copies on you and reserve the vendor's right to suspend or restrict access in defined circumstances. The legal obligation to produce records to the ATO or a regulator sits with the business, regardless of which platform holds the data today. What should I export before cancelling a software subscription? Export the general ledger, trial balance, all invoices, bank transactions and reconciliation reports, payroll records, lodgement copies, contact lists and any attachments. Do this before cancelling, not after. Once an account closes or lapses, getting the data back depends entirely on what that vendor's terms allow, and you no longer control the timeline. How often should a small business export its data? Annually is the sensible baseline, timed just after the prior financial year is finalised. Businesses with high transaction volumes or heavy reliance on a single vertical platform should consider quarterly. The value comes from the schedule, not the frequency. Does exporting data mean I can switch software easily? Not easily, but it makes switching possible. Exports preserve your records and your negotiating position. Rebuilding workflows, bank feeds and integrations in a new tool still takes work. The point is that leaving becomes a decision you can make rather than one the vendor can block.

Quotes are reproduced verbatim from r/AusLegal, r/ausbusiness and r/Bookkeeping, attributed to the subreddit only. Australian Taxation Office, Record keeping for business: https://www.ato.gov.au/businesses-and-organisations/preparing-lodging-and-paying/record-keeping-for-business. Corporations Act 2001 (Cth), section 286: https://www.legislation.gov.au/C2004A00818/latest/text