Payroll record retention in self-hosted HR systems

Payroll record retention in self-hosted HR systems: what the rules ask of your HR stack

Retention duties for US payroll and employment tax records sit with the employer, not the software vendor, so the platform must be configured, backed up and archived in a way that lets the employer meet them. The Fair Labor Standards Act (FLSA) requires employers to keep certain payroll and hours records for three years, and the IRS expects employment tax records to be kept for four years. This page does not set a US retention standard beyond those two periods. State wage laws and other rules may run longer for your workforce, so confirm the full schedule with employment counsel before you configure anything. DeployOpen prepares systems, controls and evidence for your compliance work, but it does not give legal advice or issue attestations.

Start by mapping each record type to its retention clock and owner. In a self-hosted system such as Frappe HR, OrangeHRM or Odoo, that usually means employee master data, pay rates and changes, salary slips, timesheets and attendance inputs, leave balances, and tax setup records. Decide which of these live in the HR module, which are exported to the payroll provider, and which are copied into the accounting ledger. For leavers, the common failure is an offboarding step that deletes or anonymizes the employee record before the retention period ends. Set up an archive state that keeps the payroll history readable and locked, and that is separate from any personal data purge. Confirm with counsel how the purge rules for personal data interact with these clocks, because the answer decides which fields you can remove and when.

Backups protect records only if you can restore them and read them later. Test restores on a schedule, and keep a sample of older snapshots so you can retrieve a salary slip from several years back in the same format it was produced. Plan for software upgrades over that horizon. Frappe's supported versions page lists end-of-life dates for each ERPNext and Frappe Framework release, so check that your chosen version stays supported long enough to cover the periods you need. For audit production, keep a written procedure that names who can pull a record, how exports are checksummed, and where the access log is stored. Auditors will ask for these records by employee, by pay period and by tax year, so test all three queries before you need them.

Mapping retention duties to HR and payroll configuration

This table maps each US retention duty for payroll and employment tax records to what the self-hosted system must do and how to configure Frappe HR, OrangeHRM or Odoo to meet it. Read each row as a control to confirm with your counsel, tax adviser and assessor, since settings vary by platform version. The main takeaway is that a retention period alone does not protect records: access, logging, backups and restore tests must keep them available for the full period.

Retention duty	What the system must do	How to configure it	Evidence an assessor expects
FLSA three-year period	Keep payroll and time records available for the full period, including after the employee leaves.	Document a retention schedule per record type. Disable automated purge jobs for payroll until the period ends.	Retention schedule, purge job logs, and a sample retrieval of a leaver's pay records.
IRS four-year period	Keep employment tax and withholding records for the full period measured from the relevant tax date.	Tag records by tax year and filing. Confirm the start date with your tax adviser before setting holds.	Tax record index, filed return copies, and a retrieval test for a prior year.
Record-level retention and legal hold	Block deletion of records under audit, dispute or investigation.	Use status flags or role-restricted hold actions. Confirm whether your version supports locking documents.	Hold register with start and release dates and named approvers.
Role-based access to pay data	Limit salary, bank and tax fields to payroll roles, so managers see only what their role needs.	Map roles to documents, modules and fields. Restrict field-level permissions. Avoid shared admin accounts.	Role matrix, periodic access review records, and logs of denied access attempts.
Multi-factor authentication	Require MFA for any individual accessing the system, where 16 CFR 314.4 applies to a covered financial institution.	Enforce MFA at the identity provider. Confirm LDAP or social login support for your version before relying on it.	MFA policy export, enrollment report, and an exceptions list with approvals.
Change and audit logging	Log activity of authorized users, including edits to pay rates and bank details.	Enable the platform's audit or version tracking where available. Send logs to a store the HR team cannot edit.	Log samples showing who changed a pay rate and when, plus log retention settings.
Backup and restore	Keep encrypted, restorable copies that cover the full retention period.	Encrypt backups at rest and in transit. Keep payroll exports apart from short backup rotation. Test restores on a schedule.	Backup schedule, encryption settings, and dated restore test results.
Penetration testing cadence	Where continuous monitoring is absent, test systems at least every six months under 16 CFR 314.4(d)(2).	Include the HR and payroll application and its APIs in the test scope.	Test reports, remediation tracking, and signed scope documents.

Which self-hosted platform fits which retention set-up

Odoo Community is published under the GNU LGPL version 3 and serves as the open source core on which the licensed Odoo Enterprise edition is built. When you run Community yourself, retention depends entirely on the processes around the application. Your team or partner controls the database, the file store, backups and any archiving logic, so retention decisions (which payroll and employment records to keep, for how long, and in what form) must be written down and built into operations.

Archive: Deactivate leavers and keep their records under a documented retention schedule. Confirm that archiving an employee does not break links to payroll history you must keep.
Export: Export records per leaver or per audit request, then test that the files open outside Odoo with the fields an auditor will ask for.
Deletion: Plan deletion of personal data as a scheduled, logged procedure tied to each retention period. Confirm how your version handles deletion of records linked to payroll entries.
Backups: Backups, restore tests and copies of attachments such as signed forms are your responsibility. Keep them under the same retention rules as the live data.
Vendor check: Ask Odoo which Community features are intended for archiving and export, and whether any retention behavior differs across the versions you might run.

Before go-live, document the archive and deletion procedure and test a full restore against a sample leaver.

ERPNext is licensed under GPL-3.0 and built on the Frappe Framework, which is licensed under MIT. Self-hosting ERPNext is free of license fees, but the version line you run determines how long you receive vendor fixes, which matters for any record kept for years. Frappe's supported versions page says version 14 reached end of life on January 31, 2026, that version 15 is planned to be supported until the end of 2027, and that version 16 is planned until the end of 2029. Choose a line that stays supported through the period you expect to operate the archive.

Version lines: Plan upgrades before a line leaves support, and test archived exports after each major upgrade.
Archive and reload: The Data Import tool imports and updates records from CSV or Excel files with downloadable templates. The documentation advises importing only a few thousand records at a time, so plan large restores in batches.
Server Scripts: From version 15, Server Scripts are disabled by default and must be enabled with the server_script_enabled setting. Scripted retention jobs depend on that setting, and Frappe Cloud public shared benches do not allow them.
Support coverage: Warranty coverage from Frappe requires a listed version and a matching Frappe Cloud support plan. Self-hosted teams should confirm what support they hold for the line they run.
Backups: Self-hosted installs through the bench tool or frappe_docker need a tested backup and restore routine for the database and file storage.

Confirm with Frappe or your partner how deleted or anonymized records appear in exports and backups before you set deletion rules.

Platforms that fit a retention-first HR and payroll build

Each platform below carries different license terms, release rhythms and hosting models, and each shifts where payroll and employment tax records are kept and who keeps them. The cards compare the options by the retention questions they raise: which copy is authoritative, how leavers are archived, and who restores data when an auditor asks for it.

ERPNext on Frappe

ERPNext is GPL-3.0 licensed and built on the Frappe Framework, which is MIT licensed. Both supported major lines, version 15 and version 16, receive frequent minor releases, so patch management is an ongoing duty. Confirm which Frappe major version your HR and payroll data sits on, how long each version stays supported, and whether employee records and payroll documents can be exported in a readable form for the full retention period, not only for the active system.

Odoo Community

Odoo Community is published under the LGPL version 3 and provides the open source core of the Odoo suite. Payroll localization and some HR features depend on which apps you install and on what your country requires, so check payroll rules and tax reporting for your jurisdiction before relying on the community edition alone. Confirm how you will retain payslips, leave history and contract documents when a module is removed or an app changes version, since archived data must stay readable after upgrades.

Odoo Enterprise

Odoo Enterprise is built on the Community core and adds features such as Studio customization, version upgrades and hosting. Upgrades matter for retention because records written under one version must remain accessible after a migration. Ask the vendor how Enterprise upgrade paths treat historical payroll and HR documents, which data is migrated and which is archived, and whether exports of older records remain available if a subscription lapses. Confirm the fee and hosting terms in writing before assuming they cover your retention period.

OrangeHRM

OrangeHRM is an open source HR system that many organizations use for employee records, leave and attendance. Because payroll calculation is often handled by a separate provider, the retention boundary runs between OrangeHRM and the payroll system. Verify the license edition you deploy, which employee documents and leave records are stored in the database, and how deleted or terminated employee records are handled. Your retention schedule must name the system of record for each file, including the payroll export that feeds tax filings.

Frappe Cloud or self-managed hosting

Frappe Cloud is the hosted option, and self-managed installs run on Docker Compose or the bench command line tool. The choice decides who controls backup schedules, restore testing and log retention. Confirm the backup frequency, the location and retention of backups, the restore procedure, and how long access logs are kept on whichever option you pick. Frappe Cloud pricing starts at a published monthly amount, but backup retention and support terms are contractual, so request them in writing and compare them against your own retention period.

How to archive leavers without losing payroll history

This sequence moves a leaver's payroll and tax history into a read-only, access-logged archive with a retention clock per record type, so the records remain retrievable for the full period and can be produced on request.

Freeze the leaver record
When the final pay run closes, HR and payroll lock the employee record so that no further edits to pay, tax or personal fields are possible without a logged approval. The payroll owner confirms that the final settlement, any corrections and the last payslip are posted before the lock is applied. Done means the record shows a locked status, the lock date and the approver's name, and a screenshot or export of that state is stored with the change ticket. Confirm in your own system how locking works, since field-level and document-level permissions differ between Frappe HR, OrangeHRM and Odoo.
Export payroll and tax history read-only
Payroll produces a complete extract for the leaver covering pay runs, earnings, deductions, withholding, employer contributions and year-end forms, in a format that cannot be edited after export, such as PDF plus a checksummed CSV. Someone other than the preparer checks the totals against the general ledger and the filed returns for the periods covered. Done means the extract, its hash and the reconciliation sign-off are saved together. Where you need to reload data later, use a format your HR system's import tool accepts. In ERPNext, the Data Import tool loads CSV or Excel files with downloadable templates, but the documentation advises importing only a few thousand records at a time, so plan archive reloads in batches.
Move the archive to controlled storage
The extract moves to a storage location separate from the day-to-day HR application, with encryption at rest, restricted write access and a named custodian. Access is limited to HR, payroll and audit roles, and every read and download is logged with user, time and purpose. Done means the access policy is written down, a test user without rights is denied, and a test read appears in the log. Do not assume the HR application's built-in audit trail meets this need without checking what it records and how long it keeps it.
Set a retention clock per record type
Each record category gets its own retention period and trigger date, because the US rules that apply to payroll and employment tax records do not all run from the same event. For example, the FLSA recordkeeping rule and the IRS employment tax rule set different minimum periods, and the trigger date may be the pay date, the filing date or the separation date. Confirm the periods against the current regulations with your employment counsel and tax adviser before configuring anything. Done means a retention schedule lists each record type, its period, its trigger and its owner, and the archive stores that date with each item.
Test retrieval before the source is retired
Before the live record is removed or anonymized, the team retrieves a sample leaver's history from the archive and produces a payslip, a year-end form and a pay register for a given period. Someone outside payroll checks that the figures match the original. Done means the test is documented with the sample, the retrieval steps, the time taken and the sign-off. If retrieval fails, fix the archive before retiring the source. Server Scripts are disabled by default from version 15, and they cannot be assumed to automate this test or the archiving itself, so budget for manual steps or a tested export job agreed in the scope.
Document and execute the disposal step
When a retention period ends, the custodian approves disposal of each record set in writing, checks that no legal hold or open audit applies, and destroys the copies in every location, including backups where the retention schedule requires it. Done means the disposal log records the record set, the date, the approver, the method and the backups covered. Keep the disposal log itself for as long as your schedule requires, because it is the evidence that deletion followed policy. Ask your implementation partner how backup rotation interacts with disposal, since a deleted archive may persist in older backup sets until those expire.

Evidence auditors ask for on payroll records and which component produces it

This table maps each evidence item an auditor or labor inspector may request for payroll records to the system component that produces it. Use it to check whether your Frappe HR, OrangeHRM or Odoo setup can answer those requests before an assessment starts. DeployOpen prepares this evidence, but auditors and certification bodies draw any conclusions from it.

Evidence item	What it proves	Component that produces it
Retention schedule by record type	Which payroll, tax and leaver records are kept, for how long, and the legal basis chosen for each	Written schedule approved by HR, payroll and legal, linked to configured archive rules
Application audit log of payroll changes	Who changed pay rates, deductions or bank details, when, and from which value to which value	Application audit log with change history enabled on payroll and employee master records
Access logs for payroll and leaver files	Which users opened or exported records containing pay and tax data	Web server and application access logs, forwarded to a central log store with retention set
Access review records	That only current payroll and HR roles can reach pay data, and that stale access was removed	Quarterly role and permission export reviewed and signed by the record owner
Backup job records	That backups ran on schedule, covered the database and attached files, and were stored off-host	Backup job logs, job exit status and storage location records from the backup tooling
Restore test results	That a backup can be restored and that restored payroll data matches the source	Dated restore test reports with checksums or record counts compared against production
Archive index for leavers	Where each leaver's record set sits after exit, and that the index matches the archive contents	Archive index generated at exit, with file hashes and a link to the retention rule applied
Proof that leavers' records were not altered	That archived records match what was stored at exit and any later access was logged	Hash manifest taken at archiving, compared on periodic checks, plus audit log entries for any access
Configuration change records	Who changed payroll rules, tax tables or retention settings, and that changes were approved	Version control history or change tickets for configuration, custom scripts and deployment settings

What tooling alone does not satisfy

Self-hosted HR and payroll software can keep records, but it does not decide how long they must be kept, prove they are intact, or make them retrievable years later. The cards below cover the decisions and checks that sit with the employer, and each one names what to add on top of the platform.

Retention is the employer's decision

The software stores whatever fields and documents you configure, but it does not know which records fall under FLSA, IRS or state rules, or for how long. Write a retention schedule that lists each record type, its governing rule, its minimum period and its disposal step. Assign a named owner, usually HR with payroll and legal sign-off, and review the schedule when rules or entities change. Confirm the periods with counsel or your tax adviser rather than relying on a vendor default.

Backups are not archives

A backup captures the system as it was at one moment and is usually overwritten on a rotation cycle. An archive is a deliberately preserved copy of closed records, kept on a schedule independent of the live system. Decide which records move to an archive, in what format, and where it is stored, then keep it readable after the application is upgraded or retired. Ask your partner how exports are structured so a future reviewer can read them without the original software.

Logs need tamper evidence

Application audit logs record changes to pay rates, bank details and leaver status, but a default log is only as trustworthy as the access controls around it. Forward logs to a store that administrators of the HR application cannot edit, restrict deletion, and set retention on the log store itself. Check whether your chosen platform and configuration record who viewed or exported payroll data, not only who changed it. Test by attempting to alter a log entry as an administrator and recording the result.

Restore must be tested

A backup job that reports success does not prove that payroll history can be recovered. Schedule restore tests into a separate environment at a fixed interval, and verify that employee records, pay runs, tax details and attachments all come back and reconcile to totals. Record the date, the scope, the person who ran the test and any gaps, and keep that record as evidence. Ask your partner who performs restores, how long a restore takes, and what happens to database and file store consistency.

Payroll provider data sits outside

Many employers run payroll through an external provider or bureau, so wage statements, tax filings and year-end forms may live outside the self-hosted HR system. List every system that holds a copy of pay or tax data, including the provider's portal, and assign each one a retention period. Obtain written confirmation of how long the provider keeps records after you terminate, and how you can export them. Gaps between the two systems are where records most often go missing.

Legal holds run separately

A legal hold suspends normal disposal for records tied to a claim, audit, charge or investigation, and it must override the retention schedule. Self-hosted systems do not start or lift a hold on their own, so the hold process must be written and owned by legal or compliance. Define how holds are recorded, which records and employees they cover, how deletion jobs are paused, and how the hold is released. Test that a deletion job actually skips held records before you rely on the process.

Questions buyers ask about payroll record retention in self-hosted HR

How long must US payroll records be kept under FLSA and IRS rules?

The FLSA and IRS periods differ, so keep each record for the longest period that applies to it. The three-year FLSA period and the four-year IRS period for employment tax records are the starting points, but state rules, union agreements and contract terms can run longer, and the employee file may need to outlast the payroll file. Your employment counsel and payroll tax advisor should confirm the period for each record type in writing, then turn that list into a retention schedule. The software vendor does not own this answer. DeployOpen can help turn the confirmed schedule into configured controls and evidence for review, but the legal and tax conclusions stay with your advisors.

Does self-hosted payroll software enforce record retention automatically?

Usually not by default, so confirm it in your specific build. Open-source HR and ERP tools provide permissions, document history and deletion controls, but whether a record is kept, archived or purged after a set period depends on configuration and on any jobs or scripts you add. In Frappe-based systems such as ERPNext, custom behavior can be added through Server Scripts, which the Frappe documentation describes as disabled by default from version 15 and enabled through the server_script_enabled setting. Test every deletion path, including user permissions, API calls and data imports. Then document the trigger for each rule, such as the termination date or the close of a pay period, and the person who approves exceptions.

What does it cost to set up archiving and backups?

Cost depends on scope, and DeployOpen does not publish a price list, so a quote follows from the written scope. One-time work usually covers designing the retention schedule, configuring archive and purge jobs, setting up backups, and testing a full restore. Recurring costs include backup and archive storage, hosting, monitoring, and periodic restore tests. Costs rise with the number of countries and payroll entities, the volume of historic records, the number of systems holding payroll data (payroll, accounting, identity and document storage), encryption and key management needs, and how long backups must be kept to match the longest retention period. Software licenses are one component, and the Odoo editions page explains which features, such as hosting and upgrades, sit in the paid Enterprise edition. Ask for a quote that separates design, build, testing, storage and ongoing support.

How long does a retention project take and what must we supply?

The timeline depends on how many systems hold payroll data and how much history must be archived or migrated, so the duration should come from the written scope rather than a general estimate. Your side typically supplies a list of record types with the rule that governs each one, read access to the current HR and payroll systems, sample exports for each retention period, named approvers for retention and deletion exceptions, and a storage target for backups and archives. Agree on the acceptance test before work starts, for example restoring one closed pay period and producing its records within a set time. Delays usually come from unclear retention rules, missing historic data and slow access approvals, so ask any partner to show dependencies on your staff and the sign-off checkpoints.

Can an internal team handle payroll retention without outside help?

A capable internal team can do much of this work, but gaps usually appear in testing and evidence. HR, payroll, IT and legal staff already know the record types, approval paths and pay calendar. Experienced hands are often needed for configuring archive and purge jobs without breaking payroll data, designing backups that restore to a known state, restricting administrator rights, and documenting controls in a form an auditor can follow. Before deciding, check whether anyone on the team has performed a full restore of an HR and payroll database, who will test upgrades that could break scheduled jobs, and who will run the restore test each year. A fixed-scope engagement can cover design, build and testing, and a retainer can cover ongoing support and upgrades. The company keeps ownership of the retention decision either way.

How should we prepare for an audit request for old payroll records?

Prepare by proving you can find, restore and explain a past pay period on request. Start with an index listing, for each year, the record types, where each one is stored and who can export it. Keep a restore path for backups that covers the full retention window, and record the results of each restore test. Keep an access log showing who viewed or changed payroll data, and confirm that the log is retained as well. Run a mock request, such as one employee's pay history for a closed year, and record how long it takes. Assemble a short evidence pack with the retention schedule, approvals for exceptions, backup and restore logs, and configuration change records. DeployOpen prepares systems, controls and evidence for assessments, but it does not issue audit reports, and the auditor or regulator sets what they need.

What happens to a leaver's payroll records after they depart?

The leaver's payroll and employment tax records should move to a restricted archive and stay there for the full retention period, while day-to-day access ends at termination. Define the archive trigger in the retention schedule, usually tied to the final pay date, and confirm that deactivating the employee does not delete their history. Limit archive access to named roles, and log every export. Any deletion requests or deletion after the retention period must follow the approved schedule, and they can conflict with data protection duties in some regions, so have counsel review the approach. Illustrative example: a leaver's account is disabled in identity systems on the termination date, but their payroll history remains readable only by the payroll archive role until the retention period ends.

How DeployOpen scopes, delivers and supports payroll record retention

DeployOpen plans, implements, documents and supports self-hosted open-source HR and payroll platforms inside your own infrastructure, including the retention settings, archive design and backup controls that keep payroll and employment tax records available for their required periods. Retention rules are agreed in writing with your payroll, legal and tax owners before any configuration begins.

How we scope

Written scope lists each record type, its owner and the retention period your counsel or tax advisor confirms for it.
Scope names the systems in play, such as Frappe HR, OrangeHRM or Odoo, plus payroll exports, accounting links and backup targets.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts. Ongoing support is available as a retainer.

How we build

Configure retention and archive rules for active employees, leavers and payroll runs, then test that records remain retrievable after the archive step.
Set up encrypted, access-controlled backups and run restore tests that show payroll history can be recovered in full and read back.
Document each configuration change, access role and data flow so the retention design can be explained to an auditor or examiner.

How we hand over

Deliver a retention schedule mapping record types to periods, storage locations, owners and disposal steps for your review.
Provide a runbook covering how to pull a former employee's payroll file, export records by date range and log each request.
Walk your HR, payroll and IT teams through the handover so they can operate archives, restores and access reviews without us.

How we support

Review retention settings and backup results on the agreed schedule, and after each platform upgrade or payroll rule change.
Keep the platform, its dependencies and the backup tooling patched and documented under a retainer, with changes handled through your change process.
Prepare the system, controls and evidence for your compliance reviews. Independent auditors and certification bodies issue any audit report or attestation.

Payroll record retention in self-hosted HR systems