When a trial ends, revoke the vendor's access yourself, export anything you want to keep, and ask for written deletion of trial data. Do not assume the vendor will do it for you, and do not assume an expired trial account has no data left.
Why trials leave more behind than people expect
During a trial you often connect real repositories, create service accounts and invite colleagues. If you decide not to buy, those links remain until someone removes them. Tokens do not expire because a trial did. And the findings the tool produced sit in a tenant that nobody watches.
The checklist
Day of decision
- Write down every integration you connected: source control, CI, cloud, ticketing, chat.
- Note the people who got accounts.
- Export the results you want to keep, such as findings, SBOMs and reports.
Revoke on your side
- Uninstall the app or integration from your source control organisation. Check the list of installed apps afterwards.
- Delete or rotate any API keys, personal access tokens and service accounts you created for the tool.
- Remove CI steps, secrets and webhooks that call the vendor.
- Remove the tool's browser and editor extensions from managed devices, and its CLI from build images.
- Disable single sign on connections created for the trial.
Ask the vendor
- Request deletion of the trial tenant and all data in it, including copies held by sub-processors.
- Ask for written confirmation with a date. See what a deletion confirmation should say.
- Ask them to stop marketing messages to the trial users, if that is your wish.
- Ask what trial data, if any, is kept under a legal duty and for how long.
Record it
- File the closure note: decision, date, data shared, steps completed. This helps if someone asks later what data went to which vendor.
Reduce the problem before it starts
You can limit what a trial can touch.
- Start on public or sample repositories where that tests what you need. See appsec trial on public repos or private: which is fair.
- Install on selected repositories, not the whole organisation.
- Use a dedicated service account for the trial that you can delete.
- Agree in writing at the start that trial data will be deleted at the end.
- Brief developers on what is allowed, see brief your developers before a security tool trial.
What if you buy
Convert the trial into a production setup deliberately. Re-check the permissions and repository list, since trial settings are often broader than you want for the long term. Replace any personal tokens with proper service identities.
How Safeguard fits
For a no commitment look, the free scan is a way to see a result before you connect anything of your own. Safeguard is also available in private VPC, on-prem and air-gapped deployments for evaluations that must stay in your network.
Quick check
Does uninstalling the app delete the vendor's copy of my data?
No. It stops new access. Deletion of what the vendor already holds is a separate request.
Who should own the cleanup?
Name one person at the start of the trial, with a date. Shared ownership tends to mean none.
Last reviewed: 19 October 2026.
