Ask the old vendor, in writing and before your notice date, for a complete export of findings, decisions, comments and audit logs, the retention period after the contract ends, and a confirmation of deletion when you request it. Check the contract for export rights yourself, and have counsel review anything binding. This is not legal advice.
Why timing matters
Leverage and access both shrink on the last day. Once the account is closed, exports may be slow, partial or unavailable. A written request made while you are still a customer is easier to fulfill and leaves a record that you asked.
The request list
Data to export
- All findings, open and closed, with first detected and last seen dates
- Decisions with reasons, comments, deciders and dates
- Suppression rules and ignore paths, including expiry
- Audit logs of user actions
- Project, team and tag structure
- Ticket links and integration settings
- Reports you rely on, as generated files
- Policy and gate configuration, as readable text or screenshots
Format and completeness
- A machine readable format such as JSON or CSV, with a documented schema
- A count of records per category, so you can reconcile
- A checksum or other way to confirm the file was not truncated
Terms
- How long data remains available after the contract ends
- Whether you can pay for or request a short extension for read access
- What happens to data in backups
- How and when deletion is confirmed
- Whether exports are rate limited or capped
A suggested sequence
| Step | When |
|---|---|
| Read the contract for export and retention clauses | Before choosing the new tool |
| Send the written request | At least 60 days before the end date, if you can |
| Run a test export | Right away, on one project |
| Run the full export | After cutover, while access remains |
| Reconcile counts | Within the week |
| Request deletion confirmation | After the retention window you chose |
Adjust the numbers to your contract. The point is to test early so that a problem with the export is found while you can still escalate.
Reconcile what you receive
An export is only useful if it is complete. Compare counts to what you see in the UI: number of projects, open findings, closed findings, suppressions. Spot check a few records end to end. Store the export and the reconciliation note together, and hash the files.
Consider the sensitive parts
Exports can include repository names, comments about internal systems and employee names. Treat the files as confidential, store them with access controls, and delete working copies once the migration is verified. Ask your privacy contact how long to keep the archive.
Do not rely on the UI alone
Screens can show more than an API returns. If a comment or attachment is visible in the interface but absent in the export, request it explicitly or capture it another way for high risk exceptions.
Quick check
What if the contract says nothing about export?
Ask anyway, in writing. Many vendors will provide an export as a courtesy, and the answer tells you what to plan for.
Should we keep read access after switching?
If it is available at reasonable terms, a short overlap is useful for lookups during the first audit cycle.
Last reviewed: 19 October 2026.
