When a security tool trial ends, export the results you need, revoke every access grant, ask in writing for deletion of your code, SBOMs and findings, and ask for written confirmation. Do not rely on the trial account simply expiring, because expiry and deletion are not the same thing.
What data a trial can touch
Think beyond source code. A scan trial may hold:
- Source code or snippets, if analysis runs in the vendor's service
- SBOMs and dependency lists
- Findings and triage notes
- Repository and organisation names
- User accounts, emails and SSO mappings
- Tokens, app installations and service accounts
- Logs and telemetry
Your close out has to address each category.
Step 1: export what you need
Before closing anything, save:
- Findings in an open format such as CSV or JSON
- Any SBOMs generated, in a standard format
- Triage verdicts and notes
- Screenshots of key configuration
- Your evidence log and scorecard
Store them with the decision record. See the trial evidence log.
Step 2: revoke access
Work through this list the day the trial ends, not at the end of the month:
| Item | Action |
|---|---|
| Source control app or token | Uninstall or revoke |
| CI secrets | Remove from pipeline variables |
| Service accounts | Disable and delete |
| SSO connection | Remove the trial application |
| User invitations | Deactivate accounts |
| Webhooks | Delete from repositories and chat |
| Network allowances | Remove firewall exceptions |
Check each system's audit log to confirm that the vendor integration shows no activity after revocation.
Step 3: request deletion in writing
Send a short message to the vendor contact naming the data categories above and asking them to delete them, and to tell you how long deletion takes, including from backups, and when you will receive confirmation. Ask whether any data is retained for legal or security reasons and for how long.
Keep the reply. If you are in a regulated sector, your risk team may need it. If the vendor's terms promise a retention period, compare the terms to what you were told on the kickoff call.
Step 4: confirm
Ask for written confirmation with a date. If you can, check from your side: log in and see whether the account, projects and uploaded data are gone. Ask how to verify deletion, as covered in how to verify a vendor deleted your scan data.
Step 5: clean up your side
- Remove the vendor's code snippets or config files from repositories.
- Delete any planted test vulnerabilities and test branches.
- Remove local copies of exports you no longer need.
- Close the access request tickets so the record is complete.
If you decide to buy
You may want to keep the trial data to avoid re-scanning. Say so explicitly, and check that the terms for a paid account cover the same data. Do not assume trial data transfers.
Agree it up front
The easiest time to settle all this is the kickoff call. Ask: where does data go, how long is it kept after the trial and how is deletion confirmed? If the answer is vague, treat that as a finding in your scorecard.
For a lighter first step, a self serve check such as Safeguard's free scan lets you see output before deciding what, if anything, to connect for a longer trial.
Quick check
Does an expired trial mean my data is deleted?
Not necessarily. An expired account may keep data for some period. Ask for deletion and written confirmation.
Should I keep the exports?
Keep only what you need for the decision record, store it with appropriate access controls and delete the rest.
Last reviewed: 19 October 2026.
