Records management software controls how long each record is kept, what happens when that period ends, and proves what was destroyed and why. In infoRouter, the Compliance module (licensed separately) provides retention schedules, disposition reviews and legal holds; version control and audit trails come with every license. Retention schedules are set on folders and documents, and every record filed in a folder inherits its schedule.
More than 75 Australian municipalities use infoRouter for public records management under VERS.
The Problem: Records Scattered, Retention Unenforceable
When an auditor asks for a specific document from three years ago, you need to produce it. That means the correct version, with a complete chain of custody. Most organizations cannot do this reliably because their records live across shared drives, email inboxes, and filing systems with no enforced retention rules.
The risk is not theoretical. Under GDPR, fines reach up to 4% of annual global turnover. The cost of a proper records management system is a fraction of the cost of a single violation.
“The global average cost of a data breach was $4.99 million in IBM's 2026 Cost of a Data Breach Report.”
How infoRouter Solves It
Retention and Disposition Schedules
Retention schedules define how long each kind of record must be kept. Financial documents for five years. Project records for five years. Vital records permanently. Once a schedule is applied, the document is protected from accidental or deliberate deletion until the retention period expires.
When the retention period ends, disposition workflows ensure documents are reviewed before destruction, not silently deleted. Every disposition action is logged. This is defensible deletion: documented, auditable, and repeatable. If you are still writing your schedule, see how to create a document retention schedule.
Audit Trails and Chain of Custody
Every action taken on every document is recorded with a timestamp and user identity. This includes access, modification, download, and deletion. When the auditor arrives, the evidence is already organized. infoRouter maintains a complete chain of custody from document creation through final disposition.
Granular Access Controls
Granular permissions, LDAP/Active Directory sync, and optional Windows Authentication ensure that only authorized personnel access sensitive records. Access logs record who viewed what and when. This is a requirement under SOX, HIPAA, ISO 9001, and GDPR.
Legal Hold and E-Discovery
When litigation or investigation requires document preservation, legal hold prevents any modification or deletion of affected records. Full-text search and metadata filters locate relevant documents across the entire repository, reducing the time and cost of e-discovery.
Compliance Standards Supported
infoRouter's records management capabilities support compliance with:
- SOX: financial record retention, version control, audit trails
- HIPAA: patient record access controls and retention
- ISO 9001: document control procedures and periodic review
- GDPR: data retention limits, right to erasure, access logging
- DoD 5015.2: federal records management guidelines
- VERS: Victorian Electronic Records Strategy (Australia)
Records Management for Local Government
Councils and city governments keep public records for years, some of them permanently, and must be able to show what was kept, what was destroyed and on whose authority. infoRouter is used by hundreds of city governments, including more than 75 Australian municipalities that manage public records under VERS, the Victorian Electronic Records Strategy. Customers include Barcaldine Regional Council and Goondiwindi Regional Council in Australia, and Western Bay of Plenty District Council in New Zealand.
- Retention schedules. Set a schedule on a folder and every record filed there inherits it. Part of the Compliance module, licensed separately.
- Disposition with sign-off. When a retention period ends, records go through a disposition review before anything is destroyed, and every decision is logged. Disposition reviews use Workflow, also licensed separately.
- Legal holds. A hold blocks destruction for as long as it applies.
- Audit trails in every license. Every view, edit and download is recorded, and end users cannot edit or switch off the audit trail.
- Public access without logins. With Anonymous Access, an add-on module licensed separately, residents can view and open documents in Anonymous Libraries, such as published minutes or plans, without an account. It supports hundreds of anonymous visitors.
- Records on a server the council controls. In its own data center or its own cloud account, under its own policies.
Built for This Since Day One
Retention and disposition have been core features since 1998, not bolted on to win a compliance checkbox. The architecture has been proven in production for over two decades. The edge cases your compliance team will encounter are ones infoRouter has already solved.
Frequently Asked Questions
- What happens when a document's retention period expires?
- The document enters a disposition workflow where designated reviewers evaluate whether it should be destroyed, retained longer, or transferred to permanent archive. Every disposition action is logged for defensible deletion.
- Can users accidentally delete a document that is under a retention schedule?
- No. Once a retention schedule is applied, the document is protected from accidental or deliberate deletion until the retention period expires. Only an authorized administrator can remove a schedule early, and that action is logged.
- Does infoRouter support legal hold for litigation?
- Yes. Legal hold prevents any modification or deletion of affected records. Full-text search and metadata filters help locate relevant documents across the entire repository for e-discovery.
- Which compliance standards does infoRouter support?
- infoRouter supports SOX, HIPAA, ISO 9001, GDPR, DoD 5015.2, and VERS. Over 75 municipalities in Australia rely on it for public records management under VERS standards.
- How does infoRouter maintain chain of custody?
- Every action taken on every document is recorded with a timestamp and user identity, including access, modification, download, and deletion. This provides a complete chain of custody from document creation through final disposition.
See How infoRouter Handles Your Compliance Requirements
Request a Guided Trial. We set up an evaluation with you, in the cloud or on your own server, with infoRouter Connect included, so you can test retention schedules, disposition workflows, and audit trail reporting for your regulatory environment.