What goes in the box file
| Keep | Why | Whose guidance |
|---|---|---|
| Invoices and receipts for paid posts and ads | They are documents related to business expenses, which the ATO requires you to keep, generally for 5 years. | ATO |
| The evidence behind a claim in a post | For environmental claims, the ACCC says to make sure there is clear evidence to back up every claim, and to make the evidence easily accessible to consumers. | ACCC |
| A copy of each price you posted | If two prices for the same item are displayed, even by mistake, the ACCC says the business must sell at the lowest or stop selling until it is corrected. A copy shows what was displayed, and when. | This guide’s suggestion (the price rule is the ACCC’s) |
| Screenshots and links for abusive posts | eSafety says a report to a platform, eSafety or the police needs evidence of where and when the content appeared, and that it can disappear once the account is blocked. | eSafety |
| The receipt or reference number from a report to a platform | eSafety asks for evidence that you complained to the platform first. | eSafety |
| Contracts with anyone who makes content for the page | IP Australia advises a written contract, signed before work starts, that sets out who owns the IP created. | IP Australia |
What a tax record has to say
The ATO says the minimum information on a record is generally:
- the date, amount and description of the transaction, with the relevant GST information
- the purpose of the transaction
- the relationship between the parties, if relevant.
For a page, “boosted the spring post, 3 days” is the kind of description that lets a receipt explain itself years later. If an expense was partly for personal use, the ATO says you need clear documents showing the business portion.
Five years, counted from when
The ATO says the 5-year period for each record generally starts from when you prepared or obtained the record, or completed the transaction it relates to, whichever is later. Some records must be kept for longer, and the ATO also notes that ASIC requires companies to keep records for 7 years.
A worked example
A business promotes a post for one day, 20 March 2026, pays for it that day and receives the invoice the same day. Under the general rule, the 5 years run from the later of those dates, 20 March 2026, so the invoice is kept until at least 20 March 2031. If the business is a company, ASIC’s 7-year requirement, which the ATO mentions, is worth checking on ASIC’s own pages.
Keeping them so they can’t change
Posts can be edited and deleted, which is why a record of one is worth keeping outside the platform. For tax records, the ATO is specific:
- The relevant information must not be changed, and must be stored in a way that protects it from being changed or damaged.
- If you move to a different record-keeping system, the original data still has to be recoverable.
- Keep records in English, or in a form that converts to English easily.
- You need to be able to show the ATO your records if it asks for them.
On storage, the ATO suggests regular back-up copies of electronic records, kept in a safe place, preferably away from the business premises, or in cloud storage. A page’s login can be lost to a scammer in an afternoon, as card 5 explains, and anything kept only inside the account goes with it.
Screenshots that will stand up
For abuse, eSafety’s list of what to capture is the most exact: the platform, the URL, the usernames and profile URLs, and the times and dates. It adds one firm exception: don’t take screenshots of illegal and restricted content, especially child sexual exploitation material; report its location to eSafety instead.
The same habits suit any screenshot a business keeps: a date, a link and the account name make a picture of a post into a record of it.