Post-acquisition data inventory checklist

What is a post-acquisition data inventory?#

A post-acquisition data inventory is a structured list of every system the acquired company uses, the record families each system holds, how far back the history goes, who administers it and what restrictions apply. It is built from metadata, so it needs no exports or copies of records.

Portfolio operations teams use the inventory for three decisions that otherwise get made by accident: which systems to keep or retire, what must be preserved for legal and tax reasons, and which histories might be licensable later. Integration plans that skip it often retire an old help desk or CRM before anyone asks what was in it.

Day one: secure access and stop accidental loss#

Day one data work is about preventing loss, not understanding the archive. A change of ownership is when admin passwords leave with departing staff, company cards on vendor accounts get cancelled and auto-renewals quietly lapse.

Give one person ownership of the day-one list and the authority to pause any cancellation, account deletion or plan downgrade until it is complete. Finance teams cutting duplicate tools in the first weeks are a common cause of lost history, and the loss usually goes unnoticed until someone needs the records.

Retention settings deserve a look on day one because defaults differ and deletions are often final. Slack, for example, keeps all messages and files for the life of the workspace by default, but admins can set custom deletion periods, and message and file deletion is permanent. Record what each tool is set to before anyone changes it.

• 1Collect admin credentials for every SaaS tool and move them into the group's password manager.
• 2List each subscription's renewal and cancellation dates and the card or account that pays for it.
• 3Check retention and auto-deletion settings in the help desk, email, chat and call recording tools.
• 4Suspend, rather than delete, accounts of departing employees and keep their mailboxes.
• 5Freeze planned system shutdowns or migrations until the inventory is complete.
• 6Confirm whether legal holds were in place before closing and that they still apply.

Day 30: map systems to record families#

By day 30, the inventory should map each system to the record families it holds. Applications are a poor unit on their own: one Zendesk instance may hold support tickets, warranty claims and sales inquiries, and one shared drive may hold proposals, project files and HR documents.

Day 90: confirm inherited rights and restrictions#

By day 90, the inventory should state what the company is allowed to do with each record family. Owning the company does not mean owning every record it holds without conditions; the target's customer contracts, vendor terms and notices came with it and still apply.

The transition services point is easy to miss in carve-outs. When the acquired business was part of a larger seller, years of its history may sit in the seller's ERP or CRM, and the right to extract those records may end with the transition period.

• 1Customer agreements: data use, confidentiality, aggregation and deletion clauses, including negotiated versions.
• 2Vendor terms: export rights and any limits on using exported data, especially on older plans.
• 3Privacy notices and employee notices or handbooks in force when the records were created.
• 4Prior data licenses, data sharing agreements or research collaborations the target signed.
• 5Purchase agreement representations on data, privacy and IP, and the survival period for claims.
• 6Transition services agreements that leave historic records in the seller's systems.

Inventory worksheet columns#

An inventory worksheet works best with one row for each pairing of system and record family. The columns below support integration, retention and licensing decisions without collecting any record content, and they stay useful through to exit if someone keeps them current.

Gaps that show up in acquired companies#

The most common gap in acquired companies is history held outside company-controlled systems. A founder's personal Google account, a contractor's GitHub organization or a project manager's Dropbox can hold records the business depends on, and none of them transfer with the shares.

Other gaps include help desks whose built-in export leaves out the conversations themselves, call recordings stored by a telephony vendor under a separate account, and shared drives with no clear owner. Help Scout, for example, says its in-app export covers reporting data and not the content of conversation threads, which are available through its API instead. Each gap belongs in the inventory as a row with an owner and a plan, even when the plan is to leave the records where they are.

Illustrative: a software holdco's first quarter with a new product#

Illustrative: a fictional vertical software holding company acquires an inspection scheduling product used by fire protection contractors. On day one, the portfolio operations lead learns that the support team's help desk subscription is billed to the founder's personal card and would lapse when the founder leaves.

The team moves billing to the group and confirms that conversation history back to the product's launch can still be pulled through the help desk's API. By day 30, the inventory shows that support conversations reference issues in a GitLab group owned by a former contractor, and the group takes over ownership of it. By day 90, counsel confirms the product's click-through terms allow aggregated use, but several large customers negotiated stricter confidentiality.

The holdco keeps the help desk through integration, flags the support and engineering history as a possible licensing candidate with those customers excluded, and records the decision in the inventory.

How SourceX uses a post-acquisition inventory#

SourceX uses an inventory like this as the starting point of the Supply step in the SourceX five-step transaction. The fit check asks for the same metadata, systems, record families, history and known restrictions, and nothing is shared during the initial assessment.

If a record family moves forward, the restrictions found by day 90 feed the Rights step, and the outcome is recorded in a SourceX Evidence Packet with provenance, licensing rights, permitted use, the privacy record and release authorization.