21 CFR 820.180(b) states "All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer." If, as stated, you supply product to another party, I would think that, as a minimum, that two years would be required. Be sure to justify by objective evidence the reasoning for this decision. Hope this helps.