When a software contract ends, your data should be exported to you, deleted from the vendor's systems, and the deletion confirmed in writing. U.S. Department of Education guidance recommends archival and destruction requirements so data no longer sits on the provider's systems after the contract period. Write the plan before you sign, not after. Not legal advice.
What the guidance says
PTAC's document on online educational services recommends data use, retention, disclosure and destruction provisions that define approved uses, limit sharing, and include archival and destruction requirements. It also recommends modification, duration and termination provisions that spell out each side's responsibilities when the agreement ends, particularly for data the provider holds.
That is the legal-adjacent anchor. The rest of this post turns it into practical steps for a security tool.
What a security tool may hold
| Item | Where it lives | Exit action |
|---|---|---|
| Findings and scan history | Vendor cloud or your tenant | Export in an open format, then delete |
| Code or code fragments | Depends on product design | Confirm what was stored, then delete |
| Policies and settings | Vendor console | Export so a new tool can import |
| Evidence and reports | Vendor console | Archive in your own system |
| Staff accounts | Vendor identity store | Remove and confirm |
| Backups and logs | Vendor infrastructure | Ask for the deletion window |
A six step exit plan
- Export first. Pull findings, policies and reports in a format you can read without the vendor.
- Archive what you must keep. Some evidence has to outlive the tool. Store it in your own records system.
- Request deletion in writing. Name the data classes, not only "all data".
- Ask for confirmation. A dated written statement from the vendor, signed by a named person.
- Ask about backups. Deletion from live systems and from backups may run on different clocks. Get the number of days.
- Revoke access. Remove API tokens, integrations, single sign-on links and service accounts on your side.
Put the dates in the contract
- Export window after termination
- Deletion deadline after the export window
- Confirmation deadline
- What happens if you leave without sending a request
PTAC also recommends mutual consent to changes in the agreement as a best practice. That helps here, because a vendor that can change terms alone may change retention terms too.
Test the exit before you need it
During a pilot, try an export. Open the file. Check it is complete and readable. A vendor who cannot export cleanly during a pilot will not do better under time pressure.
For the owner of the tool
Add the contract end date to a calendar with a reminder 120 days out. Early notice gives time to run a new evaluation, export data and brief staff.
See also the provisions to require up front.
Quick check
Is deleting an account the same as deleting data?
Not necessarily. Ask the vendor to confirm deletion of data classes, including backups, in writing.
When should I plan the exit?
Before signing. Put export and deletion terms in the contract and test an export during the pilot.
Sources
Last reviewed: 19 October 2026.
