When you cancel, the vendor should let you export your data for a defined window, then delete it, and tell you in writing when that is done. Agree the window, the export formats, and the deletion timeline in the contract before you sign, not on the day you leave.
What the GDPR says about contract end
For personal data processed on your behalf, the GDPR says the processor contract must provide that, at the controller's choice, the processor deletes or returns all personal data after the end of the services and deletes existing copies, unless law requires storage. That is a baseline for the personal data in a security platform, such as user accounts. It does not cover everything a security vendor holds, so write the same expectation for findings and metadata too. This is general information, not legal advice.
The exit sequence
- Notice and freeze. Agree when you stop sending new data. Disconnect integrations and revoke tokens on your side first.
- Export window. A fixed period after termination, such as a number of days you negotiate, when you can still pull data.
- Export content. Findings, SBOMs, policies, rules, audit logs and configuration, in machine readable formats.
- Deletion. The vendor deletes primary data and states when backups and logs age out.
- Confirmation. A written statement of what was deleted and when. See what a deletion certificate should say.
What to export, and in what form
| Item | Useful format |
|---|---|
| Component inventories | SBOM in a standard format, such as CycloneDX or SPDX |
| Findings and status history | CSV or JSON with stable IDs |
| Policies and gate rules | Plain text or JSON you can re-create elsewhere |
| Audit and access logs | Machine readable, with timestamps |
| Evidence and reports | PDF plus underlying data |
For export specifics, see avoiding lock-in: export formats to demand and exporting all your SBOM data.
Where exits go wrong
- No window. Access ends the day the contract does, and your history goes with it.
- Exports that omit status. You get a list of findings but not which ones were accepted, suppressed or fixed.
- Silent retention. Data is "removed from the product" but kept in analytics or backups with no end date.
- Credentials left live. The vendor still holds an access token to your repositories after you leave. Revoke it yourself on day one.
Ask these questions now
- How many days do we have to export after termination?
- Is the export self service, or a support request with a lead time?
- What is deleted at the end of the window, and what lingers, for how long?
- Will you confirm deletion in writing, including sub-processors?
- What happens to the data if the vendor is acquired or shuts down?
Try it yourself
Click through it at your own pace, or open it full screen. Picture exporting this inventory as a file you own, and check whether your vendor can do that.
How Safeguard fits
Safeguard covers SBOM and dependency scanning, and deploys as SaaS, private VPC, on-prem or air-gapped, so for some buyers the data never leaves their own environment and exit is simpler. You can check outputs with the free scan.
Quick check
Is deletion automatic when I stop paying?
Not necessarily. It depends on the contract. Ask for a stated timeline and written confirmation.
Should I revoke access before I cancel?
Yes. Remove the app installation and tokens from your source control and cloud accounts yourself, so access ends when you decide, not when the vendor gets to it.
Sources
Last reviewed: 19 October 2026.
