We fired a vendor in 2024. Their copy of our customer list outlived the contract.

We fired a vendor in 2024. Their copy of our customer list outlived the contract.

The invoice stopped in April. We assumed that was the exit. Fourteen months later, while prepping a cyber insurance application, we asked a simple question as part of the vendor review: "who currently holds a copy of our customer data?" The cancelled survey tool was still on the list. Same 4,100 customer emails, same ticket notes, sitting on someone else's servers under someone else's password policy — billed at zero, but not gone.

Cancellation is a billing event. Offboarding is an access, data, and billing event. We had done exactly one of the three. Here's the checklist we now run for every vendor exit, and the four failure modes it exists to catch.

Read the exit clause before you send the cancellation email

The levers you'll want later were agreed months ago, in the contract and the DPA:

• Notice period. 30 days is common. Miss the window and the contract auto-renews — now your offboarding runs against an extra term you didn't want.
• Data return. Which export format, how long the vendor keeps it available after termination.
• Deletion timeline. Most DPAs say "30–90 days after termination" for primary data, longer for backups. That means deletion is a date, not an event. Put it in the calendar.

Export what you own while you still have admin

The day admin access ends, so does your leverage to get anything out. Before cancelling:

• Primary data — customers, tickets, documents.
• The user list — who had accounts. This becomes your untangle list.
• Audit logs and config. "Your data" exports rarely include logs unless you ask. Future postmortems need them.
• Anything you paid to produce — templates, automations, custom fields. Recreating these costs more than the subscription ever did.

And store the export where your actual backups live. An export inside the same vendor's cloud isn't a backup; it's the same failure mode with a different filename.

The untangle list

Vendors connect through more doors than a password:

1. The SSO app entry. If the tool is in your identity provider, it authenticates until you remove it. Cancelled billing revokes nothing.
2. API keys and tokens. Every integration, webhook, and "connect" button someone clicked. These survive cancellations for years — and die silently, usually inside a cron job nobody watches.
3. DNS records. Email routing, verification TXT records, anything the vendor ever asked you to add.
4. Your card. Cancel in the billing settings and screenshot the "cancelled" state. "I emailed them" is not a cancellation record.

Ask for deletion in writing, with a date

Don't assume cancelling deletes anything. A five-line email referencing the contract: name the data ("all customer personal data associated with account X"), ask them to include backups in the timeline, and request a named written confirmation. If their DPA says 90 days, your verification date is 90 days out — one calendar entry, one follow-up email. Vendors answer the second email.

Verify instead of trusting

Three checks, ten minutes:

• Try the old login. SSO removed + password rejected = the door is actually closed.
• Next statement: nothing auto-converted to a "free tier" with your card still on file.
• Calendar entry for the deletion confirmation. Yes/no.

The four failure modes

1. The ghost login — the SSO entry outlives the invoice. Found by an audit, not by an alert.
2. The living API key — a script in another tool still holds the vendor's token and breaks quietly during their data purge.
3. The auto-renew you meant to kill — real intent, missed notice window. Renewal prompts are where this gets caught; that's exactly where our SaaS sprawl audit looks.
4. "Deletion" that meant cancellation — no written request, no date, no confirmation. Their retention policy keeps your data indefinitely, and the next thing you hear about it is their breach notification in your inbox.

The rule we landed on: a vendor exit is complete when access, data, and billing are all three verifiably closed. Vendors you keep get an annual security review. Vendors you fire get an exit record. The only bad vendor relationship is the one you can't prove is over.

The full checklist — clause reading, export list, untangle list, the deletion email, and the verification loop — is on our ops notes site: Vendor Offboarding & Data Deletion Checklist.

If you're building the incident-response muscle around all of this, the Ops Starter Kit gives you the fillable plan, severity matrix, and comms templates in about 20 minutes — and the free First 30 Minutes one-pager is the quick-start version. Launch week: 30% off any paid kit with code HIVE-LAUNCH30.

What's the longest a "cancelled" tool has kept your data? We're at 14 months and honestly a little afraid of what a second pass would find.