Consolidated legacy archives across portfolio companies: access and security controls

What controls does a consolidated legacy archive need?#

A consolidated legacy archive needs four core controls: entity ownership, segregation, access review and retention tracking, backed by logging and encryption. Holding groups usually build a shared archive for sound reasons, such as retiring a duplicate help desk or an acquired company's on-premises servers, and then find it has become the least governed system in the group.

Each control should produce evidence a group COO can show a board, an acquirer's diligence team or a prospective data licensee without reconstructing history from memory.

Who owns an archive after the acquired company is merged or retired?#

An archive belongs to the legal entity that collected the records, even after that company's systems, staff and brand have been folded into the group. Shared services can be the custodian that runs the storage, but custody is not ownership, and the difference matters when the subsidiary signed the contracts and published the privacy notices.

Mergers blur the line. When one subsidiary is merged into another, its records may pass to the surviving entity together with the customer agreements, data processing addendums and privacy promises that limited how they could be used. Those obligations generally travel with the records rather than resetting at closing, so ask counsel how they apply to each record set.

Record the answer in an archive register, with one entry per record set rather than per company, because a single acquisition often leaves several systems behind.

• 1Original legal entity, and the successor entity if it was merged
• 2Source system, such as an old Zendesk instance, a self-hosted GitLab server or an on-premises SQL Server database
• 3Record families and the date range actually present in the export
• 4Governing customer agreements, DPAs, privacy notice versions and vendor terms
• 5Business owner who approves use, and custodian who runs the storage
• 6Retention rule, deletion trigger and any active legal hold

How should archives from different portfolio companies be segregated?#

Archives from different portfolio companies should be segregated so each entity's records can be found, restricted, released or deleted without touching another company's records. Segregation lets a group answer a narrow question narrowly: one customer's deletion request, one subsidiary's breach analysis or one company's licensing scope.

Shared storage is fine; shared boundaries are not. The common failure is one cloud bucket with a folder per acquisition and one admin group over all of them. A permission granted at the top flows down to every company at once, and a search index built across the share quietly joins records that different contracts governed.

How do you review access to archives nobody opens every day?#

Access to a legacy archive should be reviewed on a fixed calendar and after every role change, because archives are where stale permissions survive longest. A live help desk shows its users every morning; an archived export in cold storage can keep a departed engineer's access for years without anyone noticing.

Default to no standing access. Give named custodians the minimum they need, route other requests through a ticket with a business reason and an end date, and keep a logged break-glass account. Close shared admin logins inherited from an acquired company's IT contractor during integration, not at the next audit.

• 1Export the current permission list for each entity's archive, including service accounts and API keys.
• 2Send each business owner the list for their entity only, to confirm or remove every entry.
• 3Remove anything not confirmed, then check that the removal took effect.
• 4Compare access logs with the confirmed list to catch unexplained use.
• 5File the signed review with the archive register and set the next review date.

Which retention clocks keep running after a system is retired?#

Retention clocks keep running on three fronts after a system is retired: the group's own legal and contractual obligations, the vendor's deletion window on any cancelled subscription, and deletion rules configured inside the old system. Missing one can destroy records the group still needs, or keep records it promised to delete.

Vendor windows are the easiest to miss because they start when someone cancels a subscription to save money. Atlassian states that after a cancelled subscription period ends, the site stays accessible for 15 more days and is then deactivated, with data retained for 60 days on Free, Standard, Premium and Enterprise plans (15 days for trials) before permanent deletion. Microsoft says it keeps customer data in a limited-function account for 90 days after a cloud subscription ends so the customer can export or renew.

Old systems can also carry their own deletion automation. Zendesk admins can create ticket deletion schedules that keep deleting archived tickets matching their criteria, and deleted tickets cannot be restored, so check for active schedules before assuming the full history was exported. Confirm every vendor window against current documentation for the plan.

Illustrative: a software holding group untangles four acquisitions#

Illustrative: a fictional group that buys vertical market software companies had acquired a self-storage management platform, a field service tool for pest control operators, a fleet inspection app and an accounting add-on for construction firms. During integration, shared services exported each company's old help desk, issue tracker and CRM into one cloud storage account, with a folder per company and a single admin group drawn from group IT.

The trigger was a routine question. The fleet inspection CEO wanted to explore licensing its support and engineering history, and the group COO could not say which folders held only that company's records, who had opened them since closing, or whether a deletion schedule had run before export.

The group split the account into a container per entity with separate keys, named an owner and a custodian for each, revoked the shared admin group and ran a first access review. The fleet inspection company could then scope a licensing review to its own records alone, and a later deletion request for the accounting add-on was handled inside one container.

Preparing an archive for licensing without weakening its controls#

Preparing an archive for data licensing should happen on a copy in a separate, time-limited workspace, so the archive stays the controlled system of record. Preparation work, such as removing personal details or sampling records for review, needs broader tool access than an archive should grant.

Keep the entity boundary here too. A preparation workspace should hold one company's records for one approved scope, with its own access list, and be destroyed or sealed when the work ends. Log which record set was copied and under whose approval, who used the workspace, what left it and when it was closed.

How SourceX works with holding groups on archived records#

SourceX treats each portfolio company's archive as its own supply, even when the group runs the storage centrally. In the SourceX five-step transaction, Supply and Rights are scoped per entity, Preparation runs on copies the supplier controls, and the supplier approves the prepared output before Delivery. Large archives stay in the group's own storage or ship on encrypted drives.

The archive register, access reviews and retention schedule feed the SourceX Evidence Packet, which records provenance, licensing rights, permitted use, the privacy record and release authorization for each package. The initial fit check collects only metadata, such as systems, date ranges and record families.