Set WHMCS retention controls from an approved policy that distinguishes customer records, financial documents, support attachments and diagnostic logs. The software's deletion options do not decide which records the business is required to retain.
01 Prepare a retention decision
Identify the record type, purpose, retention period, authorised owner and any dispute or investigation hold. Include backups, external storage and exported files in the inventory. Verify that the proposed deletion does not remove records still needed to support active services or reconcile transactions.
02 Apply the appropriate control
- Open Utilities > System > System Cleanup for log, saved-email, attachment and template-cache operations.
- Choose the specific data class and cutoff date required by the policy. Keep cache cleanup separate from deletion of historical records.
- For inactive-client automation, open System Settings > Automation Settings and inspect Data Retention Settings. Review the approved period of no invoice or transaction activity and the actual population that would become eligible before enabling deletion.
- Review the option to delete associated users. The documented option deletes users who are associated only with the clients being deleted; check their account associations before enabling it.
- Back up or preserve approved evidence where required, then perform the authorised operation during a monitored period.
- Record what was removed, the criteria and the result without retaining an unnecessary duplicate of the deleted personal data.
Common questions
Does clearing Gateway Log delete invoices?
The documented cleanup removes that diagnostic log, not the transaction and invoice records. It can still remove evidence needed to investigate a payment problem.
Does pruning an old attachment remove the file itself?
The documented attachment cleanup deletes qualifying closed-ticket attachments and their stored files. Confirm the cutoff and ticket criteria before proceeding.
Is automatic inactive-client deletion reversible?
Treat it as permanent application deletion. Review eligibility and recovery arrangements before enabling it; do not test it on production customers.
Revisit retention rules after new integrations, storage changes or policy updates. A downloaded report or support copy can otherwise outlive the record retained in WHMCS.