Your vendor records retention times should follow your organization's data and records retention policies.
Exceptions would be made for
· any data or documents that by legal agreement must be destroyed or returned by a specific date
· data or documents subject to legal holds for litigation or other lawful purposes
· data that must be retained longer for audit purposes
My best recommendation is to work directly with the team responsible for your organization's data and records retention policy to ensure you comply with those requirements. And to discuss and formally document any exceptions.
I hope that helps, but I would like to know how other members handle vendor document retention.