Final tax returns, signed authorizations, engagement records, client approvals, and documented decisions belong in governed systems with retention policies, access controls, and auditability. Start with the firm’s obligationsFor firms covered by the Federal Trade Commission’s Safeguards Rule, the information security program must include administrative, technical, and physical safeguards for customer information. The IRS similarly tells tax professionals to maintain a Written Information Security Plan tailored to the size, scope, complexity, and sensitivity of the practice. If staff make that decision in the moment, convenience usually wins and the most familiar tool becomes the archive. It should not be used for tax documents, regulated client data, production financial workflows, or other high-risk information.