Organizing your files: a shared drive and records system that outlasts any volunteer

This guide is for small charities whose files are spread across volunteers' laptops, personal email and three different cloud accounts. When a treasurer steps down or a laptop dies, the bylaws, grant agreements or last year's receipts can disappear with them. After reading, you'll be able to set up one shared place for the charity's files, a folder structure anyone can follow, a simple naming rule, sensible access, and a plan for what to keep and for how long.

We don't recommend any particular storage service. Ask about nonprofit pricing; our guide to free and discounted tech explains how to find them.

Why it matters

The IRS expects charities to be able to show their records. Its compliance guide for public charities, Publication 4221-PC, says a charity "must maintain books and records to show that it complies with tax rules," and that without them "the organization may lose its tax-exempt status or be classified as a private foundation rather than a public charity." It also says to keep supporting documents "organized by year and type of receipt or expense" and to "keep records in a safe place."

Good files also help when you apply for a grant, answer a donor's question, hand over a role, or recover after a fire or flood. Our continuity planning guide covers that side.

One place, owned by the charity

• Choose one shared storage service for all charity files, and stop using personal accounts for charity work.
• Register it to the charity, using a role email address such as admin@yourcharity.org, not one person's personal email.
• Give at least two people admin rights, with two-step login turned on. Our cybersecurity basics guide explains how.
• Move existing files in as people find them. A short "files amnesty" at a board meeting, where everyone uploads what they have, works well.

A folder structure anyone can follow

Keep it shallow and boring. Most small charities can start with a handful of top-level folders like these:

Inside Finance and Fundraising, add a folder for each fiscal year (for example "FY2026"), so closing a year means moving one folder to the archive.

A simple file-naming rule

Agree one rule and write it at the top of the shared drive. For example:

YYYY-MM-DD short-description version

• 2026-03-14 board minutes approved
• 2026-07-01 community foundation grant agreement signed
• 2026-09-30 bank reconciliation checking

Putting the date first, as year-month-day, makes files sort in order. Avoid "final", "new" or "latest" in names; use "draft" and "approved" or "signed" instead, and delete or archive old drafts once a document is final.

Who can see what

The FTC's guide to protecting personal information says to keep access to people with a "need to know." In practice:

• Most folders can be open to all active volunteers and staff.
• Restrict personnel files, background checks, donor payment details, and records about the people you serve to the few people who need them.
• Don't keep what you don't need. The FTC's principles include "Scale Down: Keep only what you need for your business" and "Pitch It: Properly dispose of what you no longer need." Our data privacy guide covers personal information in more detail.
• Review access when someone leaves, using our account handover checklist, and at least once a year.

Backups

CISA's Cyber Essentials says to "maintain inventories of critical or sensitive information," "establish regular automated backups and redundancies of key systems," and protect backups with "physical security, encryption and offline copies." A cloud service that syncs files isn't always a backup: if a file is deleted or encrypted by ransomware, the change can sync everywhere. Check whether your service keeps old versions and deleted files, and for how long, and keep an extra copy of the most important records.

What to keep, and for how long

Publication 4221-PC says some records should be kept permanently: "the application for recognition of tax-exempt status, the determination letter recognizing tax-exempt status and organizing documents, such as articles of incorporation and bylaws, with amendments, as well as board minutes."

For other records, it says to keep those that support an item on a return until the statute of limitations for that return runs out, which it says is generally "three years after the date the return is due or filed, whichever is later," and to keep employment tax records "for at least four years after filing the fourth quarter for the year." The IRS's general page on keeping records puts the employment tax rule as "at least 4 years after the date that the tax becomes due or is paid, whichever is later," so count four years from whichever of these dates is latest. It adds that you may need to keep records longer "for other legal purposes, including state or local tax purposes." Grant agreements may set their own retention periods too.

These are federal minimums. Our document retention policy template uses the same IRS periods: it keeps founding documents, board minutes and the determination letter permanently, keeps payroll and employment tax records for at least 4 years, and suggests keeping bank, accounting and donation records for at least 7 years. That 7-year period is our suggestion, not an IRS rule, and your state, funders or insurer may require longer. Write your periods into the policy, and review the archive once a year to delete what you no longer need to keep.

Your checklist

• All charity files are in one shared service registered to the charity
• At least two people have admin rights, with two-step login
• We have a simple folder structure and a written file-naming rule
• Sensitive folders are restricted to the people who need them
• We know how our files are backed up and how to restore them
• Permanent records (exemption application, determination letter, articles, bylaws, minutes) are stored safely
• We have a document retention policy and review the archive yearly
• We check access whenever someone leaves