Compliance
What custody contributes, and what it does not
Storage vendors love the word compliant. Storage cannot make you compliant. What it can do is produce the physical custody and evidence a programme relies on — so here is exactly where the line sits.
Bring your retention schedule. We will tell you what it actually costs to meet it.
These pages are general background, not legal advice.They do not state retention periods and they do not certify that any arrangement satisfies any rule. Requirements change and vary by firm. Get the answer from your counsel, then tell us what you need us to do.
HIPAA
HIPAA is not a storage product you can buy. It is a programme, and physical custody of media is one component of it. What a vault contributes is evidence: where media was, who moved it, and proof it was destroyed when retention ended.
Read more →
FINRA & SEC Books and Records
This is the most prescriptive record-keeping regime we encounter. Rules address not only what must be kept, but how it must be preserved and how quickly it must be produced. Examiners ask custody questions, and custody questions need custody answers.
Read more →
Sarbanes-Oxley (SOX)
SOX is a controls regime. Auditors test whether a control operated, not whether it was described. A custody record showing that every rotation happened on schedule is the kind of evidence that survives testing.
Read more →
PCI DSS
PCI has explicit expectations about physical media: secure storage, controlled distribution, logged movement, and destruction when the data is no longer needed. That maps to custody more directly than most frameworks do.
Read more →
Florida Records Retention
Retention obligations in Florida arrive from several directions at once — professional rules, industry regulators, contracts, and litigation holds. They rarely align, and the practical result is that most businesses keep everything forever.
Read more →
Bring your retention schedule.
Tours are private and by appointment. You will see the vault door, the man-trap entry, and the box sizes in person. No account relationship is required to visit.