Transition services agreements: securing data access before day one

What should a TSA say about data access?#

A transition services agreement should treat data access as a defined service with deliverables, not as a general promise to cooperate. In a carve-out, the business being bought often runs on the seller's ERP, CRM, helpdesk and email tenant, so the buyer's records sit inside systems the buyer will never own.

The TSA's data schedule should name each system, the record families inside it, the extract format, the depth of history, the delivery dates, the acceptance test and the end of access. Integration leads who leave these to a post-close working group often find the seller's IT team has already moved on to its own priorities.

Why carve-out data access fails#

Carve-out data access fails most often for three reasons: the records are commingled, the seller's admins control the export tools, and the vendor's subscription terms bind the seller rather than the buyer. Each can be handled in the TSA if it is spotted before signing.

Commingling means the division's records share objects, ledgers and inboxes with the seller's retained businesses. Someone has to define the filter that separates them, whether a business unit field, a record owner, a brand or a branch code, and both sides should agree it in writing.

Vendor terms matter because the seller's licenses may not allow use by or for a third party, and some vendors gate fuller exports behind plan tiers or approval. Slack, for example, says exports covering private channels and direct messages are offered only on Business+ and Enterprise plans and that owners must apply to use them.

The TSA data clause checklist#

The TSA data clause checklist below covers the terms that most often decide whether a buyer ends the TSA with usable records. Counsel will adapt the drafting; the categories are what an integration lead should insist on seeing.

Depth of history: the clause that gets cut#

Depth of history is the clause most often cut short, because a seller's default export and a buyer's first request both lean toward current records. For warranty claims, disputes, analytics or a later licensing decision, the closed records with full comment threads are the valuable part.

Export tools differ by vendor and plan. According to Salesforce Trailhead, the Data Export Service allows a manual export once every 7 days on Enterprise, Performance and Unlimited Editions and every 29 days on Professional and Developer Editions, so a schedule that assumes on-demand exports can miss its date. Zendesk says its account export tools are not available on Team plans, though the REST API works on every plan.

Write the expected route into the schedule: built-in export, API extract, database backup or vendor-assisted export. Where an API is used, name who runs the script, against which objects, and how attachments and audit history are included.

Steps to take before signing#

Integration leads can secure most data terms before signing with a short discovery round with the seller's system owners. None of these steps moves data; they collect metadata and a sample to test against.

• 1Get a system list for the carved-out business from the seller, with owners and vendors.
• 2Ask for record counts and date ranges per system.
• 3Agree the filter that separates the business's records from the seller's retained records.
• 4Request a sample extract of one record family to test format and links.
• 5Read the seller's vendor contracts for third-party use, export and deletion terms.
• 6Draft the data schedule with deliverables, acceptance tests and dates.
• 7Set up buyer-side storage and an owner for incoming extracts before the first delivery.

Ending the TSA: final extract and deletion certificate#

The TSA exit should end with a verified final extract, a confirmed end of buyer access and a deletion certificate covering the seller's copies of the buyer's records. Sellers usually keep some copies for their own legal, tax or audit duties, and the certificate should list those exceptions instead of claiming complete deletion.

Backups need explicit treatment. Many organizations cannot delete single records from backups and let them expire on rotation instead; the certificate can describe that rotation and confirm the copies will not be restored for other use. Where the business had its own subscription in the seller's name, the vendor's clock applies once the seller cancels: Zendesk's Service Data Deletion Policy starts permanent deletion 90 days after cancellation, and the process cannot be reversed once it starts.

Retained copies also matter commercially. If the buyer later wants to license the records, a seller holding a usable copy weakens any exclusivity the buyer can offer, so the purchase agreement and TSA should say what the seller may do with what it keeps.

Illustrative: a mechanical services platform carves out a service division#

Illustrative: a fictional commercial HVAC and mechanical services platform buys the service division of a larger mechanical contractor. The division's service agreements, work orders, equipment histories and technician notes live in the seller's field service system, its customers in the seller's CRM, and its staff email in the seller's Microsoft 365 tenant.

The integration lead writes a data schedule naming each system and using the division's branch codes as the filter. The interim extract shows that equipment photos and technician notes were missing, and the gap is fixed before the final extract. Access ends after acceptance, and the seller's deletion certificate lists retained accounting records and the backup rotation.

The platform leaves the TSA with linked service histories it controls, which supports dispatch, warranty work and any later decision about the records.

How SourceX looks at carve-out records#

SourceX reviews carve-out records through the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. In the Rights step, the purchase agreement, the TSA and the deletion certificate together show which entity owns the records and whether the seller kept copies. The SourceX Evidence Packet then records provenance, licensing rights, permitted use, the privacy record and release authorization, and the supplier approves each step.