Wind-downs and transitions
Customer contracts after shutdown: confidentiality clauses that survive
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Confidentiality survives termination in most customer contracts, so a company that shuts down remains bound to protect customers' confidential information in its email, tickets and files. Before any archive is sold or licensed, build a contract matrix of survival, use-restriction and destruction clauses, then exclude whole accounts where contracts forbid use and redact the rest.
Key takeaways
- Survival clauses keep confidentiality, use limits and return-or-destroy duties alive after a contract ends.
- A shutdown does not end those duties, and an assignee, trustee or buyer holding the records should assume they still apply.
- Removing customer names does not make confidential business information, such as pricing or designs, safe to use.
- Exclude by account where a contract forbids use or required destruction, and redact by field where it protects only identity.
Do confidentiality obligations end when the company closes?#
Confidentiality obligations generally do not end when a company closes, because customer contracts typically say they survive termination. A typical survival clause lists the sections that stay in force after the agreement ends, and confidentiality, limits on use, return or destruction of data, indemnities and governing law are usually on that list.
Survival can run for a stated period after termination or indefinitely, and many contracts protect trade secrets for as long as they remain trade secrets. In practice, the safest assumption is that the duty travels with the information. A wind-down officer, an assignee or a trustee who controls the archive should assume they hold it subject to the same obligations.
Which clauses survive and what they restrict#
The clauses that survive are spread across the contract, so read the whole agreement rather than the confidentiality section alone. The table maps the common ones to what they restrict once the business is closing.
| Clause | What it usually says | Effect on a closed company's archive |
|---|---|---|
| Confidentiality | Protect the other party's confidential information and use it only for the agreement | Customer information in tickets, email and files cannot be reused or disclosed |
| Use restriction | Data may be used solely to provide the services | Blocks new uses such as licensing, unless an exception applies |
| Return or destruction | Return or destroy customer data on termination, sometimes with certification | Data that should have been destroyed cannot support any license |
| Data processing agreement | Process personal data only on the customer's instructions | Personal data received from customers is generally out of scope |
| Aggregated data rights | Provider may use aggregated or de-identified service data | May permit limited use of prepared operational records |
| Publicity | No use of the customer's name without consent | Customer names stay out of any materials and descriptions |
| Assignment | Rights transfer only with consent or to a successor | Affects who may hold and act on the contract after closing |
| Survival | Lists which sections outlive termination | Confirms which of the above still apply |
Where customer confidential information hides in an archive#
Customer confidential information hides in ordinary operating records, not only in folders labeled with a client's name. Email and chat are the hardest, because a single thread can mix internal discussion with a customer's pricing, architecture or plans, and messages often quote other companies' NDA-covered material.
- Support tickets with customer screenshots, configuration exports or log files.
- Engineering issues that reproduce a customer's bug with the customer's data.
- CRM notes recording negotiated pricing, discounts and renewal terms.
- Shared channels with customers, where both sides' messages sit in one history.
- Call recordings and transcripts from implementation and account reviews.
- Shared drive folders holding customer-provided files and deliverables.
- Proposals and statements of work that describe a customer's operations.
The survival clause checklist#
The survival clause checklist turns a pile of agreements into a matrix that legal and the data team can both use. Record one row per customer and per NDA, including expired and terminated agreements from the period the archive covers, because the records outlived the contracts.
Do not forget agreements that never became customer contracts. Mutual NDAs signed with prospects, channel partners, integration partners and potential acquirers often protect information sitting in the same email and CRM archive, and they are easy to miss because no billing system tracks them.
- Agreement type, parties, signature date, end date and governing law.
- Survival clause text and any stated survival period.
- Definition of confidential information and its exclusions.
- Use restriction wording and any permitted use of aggregated or de-identified data.
- Return or destruction duty, whether certification was requested and whether it was given.
- Any explicit prohibition on AI or machine learning use of customer data.
- Assignment and successor provisions.
- Notice requirements for termination, closing or a change of control.
The exclusion approach: exclude, redact or keep#
The exclusion approach applies the matrix to the records: exclude whole accounts where a contract forbids use or required destruction, redact fields where a contract protects only identity or specific information, and keep material that describes the company's own work. Exclusion by account is coarser, but it is far easier to prove later than redaction scattered through an archive.
| Content | Default treatment | Reason |
|---|---|---|
| Records of customers whose contracts prohibit any reuse | Exclude the whole account | Use restriction survives termination |
| Records that should have been destroyed at termination | Exclude, and address the destruction duty | No license can rest on data that should not exist |
| Customer-provided files, data and deliverables | Exclude | Customer property and confidential information |
| Customer names, contacts and identifiers in tickets | Redact or replace | Confidentiality and publicity clauses |
| Pricing, discounts and negotiated terms | Exclude | Commercially sensitive confidential information |
| Internal discussion of the company's own process | Keep after review | The company's own information, once customer details are removed |
What if a contract required destruction at termination?#
A contract that required destruction at termination creates a duty the closing company must deal with before anything else. If the customer data should already have been deleted, it should not appear in any license, and counsel may advise completing the destruction and documenting it.
Destruction duties can collide with retention law, litigation holds and the need to keep records for claims. Where they conflict, counsel decides which obligation controls, and the archive should record the decision. Data kept only to satisfy a legal hold is held for that purpose and is not available for new uses.
Certification raises the stakes. If a customer asked for a certificate of destruction and the company signed one, any surviving copy contradicts a signed statement and compounds the breach, so search backups, old exports and former employees' drives for leftovers before the archive is scoped.
Illustrative: a closed 3PL builds its contract matrix#
Illustrative: a fictional third-party logistics company whose workforce peaked above 50 full-time employees closes its warehouses. Its WMS holds years of order exceptions, damage claims and carrier issues, and its email and help desk hold daily correspondence with retail and manufacturing customers.
Wind-down counsel builds a matrix of every customer agreement. Several customers required destruction of their data at termination; their records are destroyed, the destruction is certified and those accounts stay out of scope. Others restrict use to providing the services with no aggregated data exception, so their accounts are excluded. The remaining contracts permit use of de-identified operational data.
For the remaining accounts, customer names, SKUs and shipment references are replaced, pricing is removed and internal exception-handling notes are kept. The result is a narrower set of warehouse exception records with a documented basis for each account's inclusion.
How SourceX applies contract limits#
SourceX reviews customer contracts during the Rights step of the SourceX five-step transaction and records the basis for including each account in the SourceX Evidence Packet, under licensing rights and permitted use. Customer confidential information is excluded or removed in Preparation, and the supplier approves the final scope before Approval and Delivery.
Frequently asked questions
Does a buyer or assignee inherit our confidentiality obligations?
Often, in practice. An asset buyer usually takes on contract obligations only where the purchase agreement says so, but it can still face claims if it uses information it knows is confidential. An assignee or trustee stands in the company's position. Customers may still look to the original entity, so the wind-down plan should account for both.
Does an expired NDA still matter?
Often, yes. Many NDAs protect information for a period after the agreement expires, and trade secrets may be protected for as long as they remain secret. Check the term and survival language of each NDA rather than assuming that expiration ended the duty.
Does removing customer names make records safe to use?
Not by itself. Confidential information includes business details such as pricing, volumes, designs, plans and system architecture, which can stay sensitive and recognizable without a name attached. Redaction must cover the content a contract protects, not only identities.
Can we ask customers for consent at shutdown?
You can, and some customers will agree, particularly when the request is specific about what will be used and how it will be prepared. Many will not respond in time. Treat silence as a no, and keep written consents with the contract matrix.
What if we cannot find a customer's contract?
Treat the account conservatively. Look for the signed copy in e-signature accounts, email and the CRM, and check whether the customer accepted online terms instead. If no agreement can be found, exclude the account rather than guessing what it allowed.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.