Secure data destruction when closing a business: do it last, not first

Why should data destruction come last in a shutdown?#

Data destruction should come last in a shutdown because every other records decision depends on the data still existing. Final tax returns, last payroll, open claims, customer data requests and any sale or license of records all need the originals, and a wiped drive cannot be unwiped.

The pressure to destroy early is real. Leased laptops have return dates, landlords want the server closet empty, and cloud invoices keep arriving. The answer is to sequence the work so holds and exports happen quickly, not to skip them.

Waiting is also the more secure choice. Rushed destruction tends to be incomplete: a laptop is wiped but its cloud backup is not, or a server is shredded while its replica in a colocation cage is forgotten. A planned final step covers every copy because the inventory is finished first.

The five-stage order: hold, export, assess, license window, destroy#

The five-stage order turns destruction from a reflex into a decision. Each stage has a clear finish line, and a system does not move to the next stage until the previous one is done for that system.

Stages can overlap across systems. The help desk may sit in its license window while laptops are already being destroyed, as long as those laptops held no unique records that were never exported.

What counts as company data to destroy?#

Company data to destroy includes every place business information lives, not just laptops. Shutdown inventories often miss phones, copier hard drives, network storage, backup media, USB drives in desk drawers and SaaS accounts that individual teams bought on a company card.

Build the inventory from purchase records, the MDM console, the identity provider's list of connected apps and card statements, not from memory. Each line should name the owner, what the device or account holds, and whether that content was exported.

• 1Endpoints: laptops, desktops, phones and tablets, including personal devices enrolled in device management.
• 2Servers and storage: on-premises servers, NAS units, storage arrays and colocated equipment.
• 3Backup media: tapes, external drives and cloud backup vaults.
• 4Embedded storage: multifunction printers, copiers, phone systems and camera recorders.
• 5Cloud tenants: Microsoft 365 or Google Workspace, file storage and line-of-business SaaS.
• 6Shadow systems: tools bought on company cards, contractor-created shared drives and old test environments.

Does cancelling a cloud subscription count as destruction?#

Cancelling a cloud subscription does not count as destruction you control, because the vendor deletes data on its own timeline and usually issues no certificate. Microsoft says it keeps customer data in a limited-function account for 90 days after a subscription ends so the customer can extract it, and deletes all data no more than 180 days after the subscription ends. Google warns that Workspace data deleted after cancellation cannot be restored and that deletion can take up to 90 days.

Those windows cut both ways. Data you meant to keep can vanish before anyone exports it, and data you meant to destroy can persist for months in a state you cannot inspect. Where a vendor offers admin-initiated deletion with a confirmation, use it after the export is verified, and keep the confirmation in the destruction log.

Check each vendor contract for data return and deletion terms before giving notice. Some contracts promise a deletion certificate on request; many say nothing about it.

Which destruction methods and proof should you use?#

Destruction methods should match the media and leave proof that a third party can check. NIST Special Publication 800-88, the federal guideline for media sanitization, is the reference most IT teams and certified destruction vendors use to choose a method for each kind of media.

Ask destruction vendors for chain-of-custody records from pickup to shredding, a certificate listing serial numbers and a description of the method used. File the destruction log with the corporate records the custodian keeps after dissolution, since it is the evidence that equipment left the company clean.

Illustrative example: a software company that almost wiped too early#

Illustrative: a fictional B2B software company decides to shut down. The lease on its laptops ends soon, so the office manager schedules a factory reset of every device, and the finance lead plans to cancel Google Workspace, Zendesk and Jira in the same week.

The wind-down officer reorders the plan. Retention policies are paused, and laptops of departing engineers are imaged because two of them hold design notes that never reached the shared drive. Full exports are taken from Workspace, the help desk and Jira, each verified and hashed. Counsel confirms one customer dispute requires a hold on the related tickets and email.

The board then runs a metadata-only fit check on the support and engineering history and keeps a controlled copy during a license window. Laptops return to the lessor with certificates, cloud tenants are deleted after export, and the held records stay with counsel. Any licensed copy carries its own deletion terms.

How SourceX fits into a destruction plan#

SourceX works inside the license window, never before the hold and export stages. The SourceX five-step transaction runs Supply, Rights, Preparation, Approval and Delivery on a controlled copy, and large datasets stay in the company's own storage or ship on encrypted drives, so SourceX does not become one more copy to track.

The SourceX Evidence Packet records what was licensed, under which rights and with whose release authorization. That record supports the destruction log as well, because it shows which copies exist outside the company and what the license says about deleting them.