New York says Z-tapes aren't enough for a sales tax audit

Toast keeps your data accessible for 60 days after you close the account. Card data is the one record PCI DSS requires you to purge every quarter.

Lucas Hartwell

October 25, 20269 min read

Every December someone in the office asks what can go in the shred bin. The usual answer is "seven years, to be safe," which is wrong in both directions: some restaurant records have to be kept longer than that, some only for 90 days, and one category you're required to destroy on a schedule.

What follows is the published rule for each record a restaurant actually produces, with the source. Your state adds its own, and your accountant may want longer. None of it is legal advice.

The schedule

Record	Keep for	Source
Income tax records	3 years; 6 if you underreported income by more than 25%; 7 for a bad-debt deduction	IRS
Equipment purchase records	Until 3 years after the year you sell or scrap it	IRS
Employment tax records, including employee tip reports	4 years	IRS Pub 15
Form 8027 (allocated tips)	3 years after the due date	IRS
Payroll records and sales and purchase records	3 years	FLSA, 29 CFR 516.5
Time cards and wage-rate tables	2 years	FLSA, 29 CFR 516.6
Form I-9	3 years after hire or 1 year after termination, whichever is later	USCIS
OSHA 300 injury logs	5 years (caterers; most restaurants are exempt)	29 CFR 1904.33
Hiring and termination records	1 year	EEOC
Liquor purchase invoices	3 years	TTB, 27 CFR 31.191
Sales tax records	California 4, New York 3, Texas 4 years	State rules
Payroll records, New York hospitality	6 years	12 NYCRR 146-2.1

Two notes on the federal wage rules. The FLSA makes your sales and purchase summaries a three-year labor record, not just a tax one. And time cards are a two-year record on paper, but a willful violation can be pursued for three, so most employment lawyers keep them three.

The pandemic files you can't shred yet

The IRS's 2026 employer guide adds a line that matters to a lot of restaurants. Records for Employee Retention Credit wages paid after June 30, 2021 "should be kept for at least 7 years." Records for 2021 paid sick and family leave wages, 6 years. Many restaurants claimed the retention credit for the third quarter of 2021. Those payroll files don't go out with the rest of the four-year employment records.

Caterers keep injury logs. Restaurants don't.

OSHA's recordkeeping rule exempts "Full-Service Restaurants," "Limited- Service Eating Places" and "Drinking Places" from keeping injury logs. It doesn't list special food services — caterers, food service contractors, mobile food. A catering company with more than ten employees keeps the OSHA 300 log and summary for five years. A restaurant with a catering arm should check which code it actually reports under.

Your POS is your sales tax record

This is the part I'd read twice. New York's recordkeeping bulletin says "summary reports and daily summary or 'Z' tapes are not sufficient." It wants item-level detail for each transaction, and the POS audit trail "must be activated and operational at all times." Keep three years of it. A restaurant that keeps only end-of-day summaries can be assessed on an estimate.

California's rule is four years, and it addresses the POS directly: if the system "overwrites data after a period of time less than four years," the business has to move that data somewhere and keep it. The vendor's retention window is your problem, not the vendor's.

When you switch systems

That becomes urgent the day you change POS providers:

Toast: "When you close your Toast account, your data will be accessible for 60 days," and "there is no single export." Reports come out one at a time.
Square: after deactivation, you "will not be able to access any of your payment history or account information, including any 1099-K tax forms."

Put those next to New York's three years and California's four, and a restaurant that cancels without a full export can be out of compliance two months later. The POS switching guide covers the export, and the post on leaving your POS covers the rest of the exit.

The record you're required to destroy

Card data runs the other way. The PCI security standard requires stored account data to be "kept to a minimum," with "a quarterly process for identifying and securely deleting" anything past your defined retention period. Sensitive authentication data — the full magnetic stripe, the three-digit security code, the PIN block — can't be kept after authorization at all, even encrypted.

The common violation in catering is a binder of signed card authorization forms for deposits, security codes written on them. That binder is out of compliance however long your tax files are kept. Keep the receipt and the signed contract. Shred the card number. The PCI post covers who enforces this.

Catering deposits need proof for up to 540 days

Visa allows a dispute for services not received up to 120 days from the date the cardholder expected the service, capped at 540 days from the charge. A deposit taken in January for an October event can be disputed until the following February. Keep the contract, the banquet event order, proof of service and the card receipt at least that long. The chargebacks post covers the dispute itself.

Food safety logs

The model Food Code sets a few short periods, which apply where your state has adopted them:

Shellfish tags: 90 days from the date the last shellfish from the container was sold or served.
Parasite destruction records for raw or undercooked fish: 90 days after the fish is served.
Sous vide and cook-chill records: 6 months.
Time as a public health control: written procedures are required, but the model code sets no retention period. Your state may.

California adds 90 days for off-site catering temperature logs, covered in the off-site logistics post.

Tip records matter more this year

Under the new tips deduction, your 2026 W-2s report each employee's total reported tips under code TP. Those tip declarations are now the basis of your staff's own tax deduction, not just your payroll tax. A missing declaration history is a problem for them as well as for you. The no-tax-on-tips post has the details.

What I'm not going to give you

One number for everything. "Keep it all seven years" is too short for equipment and pandemic credits and illegal for card data.

Mastercard's dispute window. I didn't confirm it against Mastercard's own guide.

Your state's full list. I've given three states for sales tax and two for payroll. Check your own.

What to do

Write a one-page retention schedule from the table above, with your state's rules added.
Turn on item-level detail and the audit log in your POS, and keep three or four years of it outside the POS.
Export everything before you cancel any system.
Purge stored card data quarterly, and stop collecting security codes on paper.
File catering contracts with their deposit receipts, and keep them for at least 540 days after the charge.
Pull the 2021 payroll files out of the shred pile if you claimed pandemic credits.

Disclosure: I work at Katalyst, which sells a POS that keeps item-level sales history. Whatever you use, the rule that matters is the same: the record has to exist when the auditor asks, not just while your contract is active.

Related Katalyst products