Ask four things before anyone else builds your bots: who owns the workflow definitions, who holds the credentials, where run logs live, and how access is handed back at the end. The Wikipedia overview of RPA notes that a provider that owns the automation can make it hard to bring a process back in-house or switch providers.
Why exit planning is a security topic
Lock-in is usually framed as a cost problem. It is also a control problem. If you cannot move a bot, you cannot easily audit it, and you may be unable to revoke the provider's access without breaking a business process. That leaves you accepting someone else's pace for fixing problems.
What to ask before signing
| Topic | Question | Good answer |
|---|---|---|
| Ownership | Who owns workflow definitions and documentation? | You do, delivered in a readable form |
| Credentials | Whose accounts and secret stores do the bots use? | Yours, with the provider holding no standing access |
| Access | How does the provider's staff reach your systems? | Named individuals, time limited, logged |
| Logs | Where are run logs kept and can you export them? | In your environment, exportable |
| Changes | Who approves edits to live workflows? | You, or a joint process with records |
| Exit | What happens to bots, accounts and data at the end? | A written handover and revocation list |
| Subcontractors | Does anyone else touch your workflows? | Disclosed, with the same obligations |
Access for the provider's people
Contractors who build and support bots often hold wide access for long periods. Give each person their own named account, limit it to the systems in scope, set an end date, and review it monthly. We describe the routine in a monthly contractor access review with the audit log.
Build the exit plan on day one
An exit plan written at the end rarely works. Write it at the start, and test a small part of it.
- Keep an inventory of every bot, owner, system and account, in your own records.
- Store workflow definitions in a place you control, with version history.
- Keep credentials in your own secret store so rotating them after the provider leaves is easy.
- Document the business purpose of each bot in plain language, so a new team can understand it.
- Ask for a handover run: someone from your team operates a bot unaided while the provider watches.
- List the accounts to revoke on exit, and who does it.
Contract points to raise with your legal team
Whether a given clause is adequate is a question for your counsel. Security's job is to bring the technical questions above to the table so they can be written into the agreement.
Signs the lock-in is already here
- Nobody on your side can open a workflow definition.
- The provider holds the only copy of the documentation.
- Credentials sit in the provider's tooling.
- Changes happen without a ticket you can see.
If two or more apply, start collecting copies and moving credentials now.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation can help you keep an independent record of what runs in your environment.
Quick check
Is lock-in only about licensing?
No. It also covers who holds credentials, logs and workflow definitions, which decide whether you can audit and move bots.
When should we test the exit plan?
Early, with one small bot, so the first real handover is not the first time anyone tries it.
Sources
Last reviewed: 19 October 2026.
