What Should Be Stored in a Business Recovery Vault?

A recovery vault is a focused store of the documents and records a business is likely to be asked to produce during an incident. It is not a general file store, not a backup of the entire business, and not a password archive. It is the small, well-organised collection of evidence that proves the business is who it says it is, operates where it says it operates, and controls the accounts it says it controls.

The usefulness of a recovery vault is measured in minutes saved during an incident. A business that can produce an ABN extract, a utility bill, a lease and a photograph of the shopfront within fifteen minutes of being asked by a provider is in a different position to a business that spends two days chasing those documents while the clock is running.

The Five Categories

A good recovery vault is grouped into categories so that during an incident the right folder is obvious. Identity. Premises. Platform. People. Communications.

Identity

Identity documents prove the business is a legitimate legal entity. A current ABN extract from the Australian Business Register. For incorporated entities, a current company extract from ASIC. For trusts, the trust deed. For partnerships, the partnership agreement. For sole traders, personal identity documents of the trader.

Where the business operates under a registered business name different from the legal entity, include the business name registration. Where the business holds industry licences (motor vehicle repairer, electrical contractor, security licence, medical registration, legal practising certificate, accountant practising certificate), include the current certificate or registration.

Each identity document has an issue date. Many providers consider documents older than ninety days to be stale. The vault stores the current version and keeps the previous version as history, rather than deleting the old copy outright.

Premises

Premises documents prove the business occupies the location it claims. A current lease, licence to occupy, or title deed for owned premises. A recent utility bill (electricity, water, gas) in the business name, dated within the last three months, for the premises. A phone or internet bill in the business name. A current rates notice for owned premises.

For storefront businesses, a dated photograph showing the signage, the street number and the entrance. For businesses on a shared tenancy, a photograph showing the suite number and the business name on the directory board. For service-area businesses that do not have a public shopfront, a photograph of a signed vehicle or a trade licence that lists the business name and the service area.

Keep the metadata. A photograph is more useful when it has a file name and a document description that says 'shopfront signage, taken 14 March 2026' than when it is 'IMG_4823.JPG'.

Platform

Platform documents are the account-level evidence for each major digital service. For the Google Business Profile: the Place ID, screenshots of the current owners and managers, the current public listing, and recent correspondence from Google. For Meta: the Business Manager ID, Page IDs and administrator lists. For Microsoft 365 and Google Workspace: the tenant ID or primary domain, and a current administrator list.

For the domain: the current WHOIS record, the registrar name, the registrant email on file, the current nameservers and recent renewal invoices. For hosting: the account number, the current invoice, and the billing contact. For payment platforms: the merchant ID or account number, the business documents originally used to open the account and recent trading history.

The platform category is where the register and the vault meet. The register says what the business owns. The vault stores the documents that back it up.

People

The people category is a short list of who is authorised to act for the business during an incident, in a form that an external party can be shown. A director identity document (a current passport, a current driver licence) for the primary person who signs for the business. A board resolution or company authority delegating specific authority to a particular manager, where that is useful.

A copy of the current internal escalation list, naming who is authorised to speak to which provider in which situation. A current cyber insurance certificate of currency with the policy number and the insurer's incident line.

Communications

The communications category stores the templates that make a crisis quieter. A holding statement for the website if the site is down. A short social media post for an outage. A customer email explaining a service delay. A staff communication explaining what has happened and what everyone should and should not say publicly.

These are prepared in advance so that the person writing them on the day is editing, not drafting. They can be sent within minutes rather than hours.

What Not To Store

A recovery vault is not a password vault. Passwords belong in a dedicated password manager with multi-factor authentication on the manager account, individual access for each staff member who needs it, and an audit trail of who used what. Storing passwords in plain text in a shared folder is the single most common source of avoidable compromise. The recovery vault stores the information needed to recover an account; the password manager stores the credentials needed to use it.

The vault is also not a complete customer database or a confidential HR file store. Those have their own systems and their own retention rules. The vault is tightly scoped to recovery evidence.

Highly sensitive personal identity documents such as passport scans should only be included where a specific provider process truly requires them. Prefer business documents wherever they suffice.

Freshness

Documents go stale. A lease signed in 2019 is unlikely to be helpful today. A utility bill from last year will usually be rejected. The vault needs a review cadence: quarterly for the premises documents, annually for the identity documents, and immediately after any change (a move, a name change, a director change).

The simplest way to run freshness is to store a document date against each file and have the register flag anything that is older than its allowed age. The business sees a short list of items to refresh and spends a half-hour per quarter keeping the vault current.

Access Control

The vault contains sensitive information. Not every staff member needs access to the identity documents of directors, or to the signed lease. Access should be scoped to the roles that genuinely need it: usually senior management, the person who runs operations, and the person who handles incidents on behalf of the business. External providers (bookkeeper, IT provider, marketing agency) should not have standing access to the vault, although they may be given a specific document for a specific purpose, with the sharing recorded.

The vault should keep a log of who looked at what and when. This is less about distrust and more about having a clear record if a question is ever asked.

Format

PDFs are the most portable format. Providers accept them widely and they resist accidental alteration. Photographs are useful for signage and premises, and should be taken in good light with the full subject in frame. Scans of physical documents should be high resolution enough that fine print is readable; a low-resolution scan of an ABN extract may be rejected because the registration date is illegible.

File Naming

Name files so a stressed person can identify them. Prefer clear titles such as 'ABN extract 2026-03' or 'Electricity bill premises March 2026' over camera filenames. Index the vault with the same names you use in the digital asset register, because consistent naming is a retrieval strategy.

A Short Scenario From Fitzroy

A cafe in Fitzroy had its Facebook Page removed following an automated moderation action. The business was asked by Meta's appeal process to provide proof of ownership. A clear scan of the current ABN extract, a utility bill for the cafe premises dated the previous month, a dated photograph of the shopfront signage and a scan of the local council food business licence were uploaded within an hour of receiving the request. The Page was restored within four days. The owner later estimated that without the vault, the response would have taken a week to assemble and the Page would have been offline for at least three.

A Second Scenario From Western Sydney

A trades business in Western Sydney recovered a hijacked Google Business Profile in two days. The business had kept, in a well-organised recovery vault, a current ABN extract, a recent gas bill in the business name, a photograph of a signed vehicle with the business logo and phone number, and a copy of the primary technician's licence. The Google support case was escalated once, the evidence was provided in a single submission, and ownership was restored to a current director's account. The business attributed the speed to the preparation, not to any special relationship with Google.

After An Incident

When an incident ends, add the final outcome letter or screenshot to the vault, with a short note of what was resolved and how. Future responders should be able to see what already happened and what evidence worked. The vault grows over time into a quiet history of the business's dealings with its platforms, which is useful during audits and ownership transfers.

How Business Vault Fits

Business Vault provides the Evidence Vault, a structured store that groups documents by category, holds a document date against each file, surfaces anything that is going stale, and controls who at the business can see what. During an incident, the vault is pulled into the incident workspace so the responder is not switching between a dozen folders. Files are encrypted before they are written to storage, downloads are logged, and access can be scoped per team member.

A good recovery vault is one of the quiet investments that pays its cost back the first time something goes wrong. The documents are not interesting on a slow Thursday. On the morning of an incident, they are the difference between a one-day event and a one-week event.