Name the data types, set a deadline, ask for written confirmation of deletion including backups, and file that confirmation with your vendor records. Verification is mostly contractual and documentary, because you cannot inspect the vendor's systems yourself, so get the terms right before you leave.
What data an AppSec vendor may hold
| Data | Examples |
|---|---|
| Source or snippets | Cached files, diffs, code shown in findings |
| Manifests and SBOMs | Dependency lists and versions |
| Findings and history | Vulnerabilities, statuses, comments, exceptions |
| Configuration | Policies, rules, integrations, tokens |
| People data | Users, emails, role assignments |
| Logs | Access and activity records |
| Derived data | Metrics, aggregated statistics |
Each can have a different retention rule. Ask about all of them. Derived or aggregated data deserves a specific answer: is it anonymised, and can it be tied back to you?
Steps
- Export first. Take your findings, rules and reports before triggering deletion. See export findings and rules before you commit to an exit plan.
- Revoke access. Remove repository integrations, tokens and SSO connections yourself, on your side, on the day you decide to leave.
- Send the deletion request in the form the contract requires, with the date.
- Ask for confirmation within the agreed period, naming data types and systems.
- Ask about backups. Backups often expire on a cycle rather than being deleted on demand. Get the cycle length and a statement that data in backups will not be restored for use.
- File the confirmation with the vendor record and your evidence folder.
What confirmation should say
- Who confirms, by name and role
- The date and scope: tenant, data types, systems
- The method, for example logical deletion or cryptographic erase
- The status of backups and the date they will age out
- Any data retained by legal obligation, with the reason
NIST's media sanitization guidance, SP 800-88 Revision 2, published in September 2025, describes sanitization as making access to target data infeasible at a given level of effort, and covers techniques such as cryptographic erase. It is a useful reference when you ask a vendor what method they use. It addresses media sanitization in general, so use it as a vocabulary, not as a checklist for SaaS.
Contract points
Ask for a fixed deletion window, a right to a written certificate, deletion of subprocessor copies, and a ban on using your data after termination. For a related look at data return and removal, see vendor offboarding checklist.
If the vendor will not confirm
Escalate in writing, cite the contract clause, and record the gap in your risk register. Consider whether the data held is sensitive enough to demand more.
Safeguard offers compliance and evidence automation, and a free scan is at gold.safeguard.sh/scan.
Quick check
Is deletion instant?
Not always. Production data can be removed quickly, while backups may age out over a cycle. Ask for both timelines.
Can we audit the vendor to confirm deletion?
Only if the contract grants audit rights. Many rely on written confirmation and independent reports instead.
Sources
Last reviewed: 19 October 2026.
