How long should we keep W-9s?

Align with your information return and federal tax record retention policy — many U.S. organizations retain W-9s for at least seven years after the last reportable payment, or longer if state law or industry rules require it.

Is a shared Google Drive folder acceptable?

Shared folders without access logging, versioning, or role boundaries are weak for documents containing SSNs. If you use cloud storage, restrict permissions narrowly and prohibit ad-hoc sharing links.

Guide

How to Store W-9s Securely

By Keelstar Team · Updated June 1, 2026

The short answer

Store W-9s in a access-controlled system — not public shared drives or email — with encryption in transit and at rest, role-based permissions, version history, and retention aligned to your tax record policy (often seven years or longer). Link each W-9 to a vendor ID, log who accessed or exported it, and never use W-9 folders as general document dumping grounds.

Why W-9 storage is a security issue

Form W-9 contains sensitive taxpayer data — often a full SSN for sole proprietors and individuals. Treat W-9s like financial identity documents, not like generic vendor paperwork. A leaked folder is a data breach; an uncontrolled folder is a compliance failure.

Minimum storage requirements

Your storage approach should meet both IRS audit needs and data-protection expectations.

Access limited to AP, finance, and compliance roles — not all employees
Encryption in transit (TLS) and at rest
Unique vendor linkage — one authoritative W-9 per payee identity
Version history when forms are updated or re-collected
Export capability for audits without manual reassembly
No storage on personal drives, local downloads, or public links

Organization that survives turnover

Name files systematically: vendor legal name, vendor ID, and received date — or better, let a system assign IDs so renaming does not break links. When AP staff leave, access should revoke automatically. The next person should find every W-9 from a vendor record, not from a departed colleague's inbox.

Segregation from unrelated documents

Do not mix W-9s with invoices, contracts, and COIs in unstructured folders. Co-mingling makes permissioning harder and increases the chance tax documents are emailed casually. A vendor compliance record should reference each document type but store tax forms under controls appropriate to SSN data.

Logging access and exports

Auditors and security reviewers increasingly ask who viewed or exported tax documents. Systems built for compliance workflows log requests, submissions, validations, and exports by user and timestamp. That log is part of your evidence — not an optional feature.

Retention and destruction

Define retention in writing: how long W-9s stay active, when archived copies may be destroyed, and who approves destruction. Destroy securely — shredding paper, secure deletion for electronic files. Do not keep obsolete W-9s in active folders without marking them superseded; confusion drives reporting errors.

Frequently asked questions

How long should we keep W-9s?: Align with your information return and federal tax record retention policy — many U.S. organizations retain W-9s for at least seven years after the last reportable payment, or longer if state law or industry rules require it.
Is a shared Google Drive folder acceptable?: Shared folders without access logging, versioning, or role boundaries are weak for documents containing SSNs. If you use cloud storage, restrict permissions narrowly and prohibit ad-hoc sharing links.

Related guides

Put this into a monitored workflow

W-9 Collector handles this continuously — with reminders and an audit trail.

Explore W-9 Collector See the workflow