14 CFR §5.97

1. (a)Maintain records of outputs of safety risk management processes as described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation.
2. (b)Maintain records of outputs of safety assurance processes as described in subpart D of this part. Such records must be retained for a minimum of 5 years.
3. (c)Maintain a record of all training provided under § 5.91 for each individual. Such records must be retained for as long as the individual is employed by the person.
4. (d)Retain records of all communications provided under § 5.93 or § 5.57 for a minimum of 24 consecutive calendar months.