Privacy and preparation
Who controls company data after a shutdown? Custody, access and security
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Company data after a business closes still belongs to the company, and whoever acts for the company controls it: officers and directors during a wind-down, an assignee in an assignment for the benefit of creditors, or a trustee or receiver once appointed. The first practical rule is to secure admin access and verified exports before any subscription lapses.
Key takeaways
- Closing a business does not hand its records to founders, employees or vendors; the entity and its appointed representative control them.
- Custody, access and ownership are separate questions, and a SaaS vendor can hold custody of records it does not own.
- Lapsed subscriptions and orphaned admin accounts are the most common ways records disappear in a shutdown.
- Customer contracts, privacy notices and litigation holds keep applying after operations stop.
- A written chain of custody lets creditors, courts and later licensees rely on the records.
Who controls company data after a shutdown?#
Company data after a shutdown is controlled by the company itself, acting through whoever holds authority for it at that stage. During a voluntary wind-down that is usually the board and the officers it designates; once a formal process begins it may be an assignee, a bankruptcy trustee or a court-appointed receiver.
Founders, former employees and IT contractors do not acquire the records because they built the systems or still know the passwords. Vendors such as a help desk, CRM or cloud provider hold custody under their terms, but the data generally remains the customer's to export or delete within the limits of those terms.
Ownership gets harder to read after dissolution or an asset sale. State law sets how a dissolved corporation or LLC winds up its affairs, and an asset purchase agreement may move some records to a buyer and leave others behind. Check those documents before treating any archive as available for retention, sale or license.
Who acts for the company in each type of closing?#
The person with authority over records depends on how the business is closing. The table covers common situations; the governing documents and any court orders control the details, and counsel should confirm them before records are moved or licensed. This is general information, not legal advice.
| Situation | Who usually acts for the company | What to confirm |
|---|---|---|
| Voluntary wind-down | Board and designated officers, or a named wind-down officer | A board resolution naming who manages records and systems |
| Dissolution filed with the state | Directors or managers completing the winding up | State winding-up rules and the scope of remaining authority |
| Assignment for the benefit of creditors | The assignee | The assignment agreement and which assets transferred |
| Chapter 7 bankruptcy | The bankruptcy trustee | Court approval, usually required for a sale or license outside the ordinary course |
| Chapter 11 bankruptcy | The debtor in possession or a plan administrator | Plan terms, court orders and any privacy review the court may require |
| Receivership | The receiver named in the court order | How far the order reaches over records and systems |
| Acquired, then shut down | The acquirer or the seller, per the purchase agreement | Which records were assigned and which were excluded |
Custody, access and ownership are different questions#
Custody, access and ownership are three separate questions in a shutdown, and mixing them up causes most record losses. Ownership says whose records they are. Custody says where they physically sit. Access says who can actually log in and export them today.
A typical closing company spreads its records across many systems: Google Workspace or Microsoft 365 for email, Zendesk or Intercom for support, Salesforce or HubSpot for sales, Jira and GitHub for engineering, NetSuite or QuickBooks for finance. Each vendor holds custody under its own terms, and many delete customer data at some point after a subscription ends, so read each agreement and the vendor's documentation before cancelling.
Access is usually the weakest link. Super admin rights may sit with a departed IT lead, a personal email address or a contractor who has stopped responding. Recovering those accounts while the company still has staff, a billing card and its domain is far easier than recovering them afterward.
Custody checklist for wind-down officers and trustees#
A custody checklist turns those three questions into an order of work. Run it before cancelling any subscription, returning any leased hardware or letting the domain lapse.
- Inventory every system that holds records, with the vendor, plan, renewal date and named admins.
- Move super admin rights to the person with authority, and remove access for departed staff and contractors.
- Confirm litigation holds, tax and employment retention duties, and customer contract obligations to return or delete data.
- Export each system in a full, documented format before cancellation, and verify that each export opens and is complete.
- Store exports encrypted, with access limited to named people and an access log kept.
- Record a chain of custody: who exported what, when, from which system, and where it now sits.
- Keep the domain and key mailboxes alive long enough to receive vendor notices and password resets.
- Decide with counsel which records will be retained, licensed or destroyed, and document each decision.
Security risks after the lights go off#
Security risk rises after a shutdown because the people who used to watch the systems have left. Unmonitored accounts, unpaid cloud bills and laptops sitting in former employees' homes are the usual weak points.
Personal information in those records stays protected after operations stop. Privacy notices, customer data processing agreements and breach notification duties may still apply, and a security incident during a wind-down is harder to investigate and report with no staff left.
| Risk | What can happen | Control |
|---|---|---|
| Orphaned admin accounts | A former employee or an attacker exports or deletes records | Reset credentials, enforce MFA and review admin lists |
| Lapsed cloud billing | Storage buckets or databases are suspended, then deleted | Keep billing current until exports are verified |
| Expired domain | Password resets and vendor notices reach someone else | Renew the domain for the length of the wind-down |
| Company laptops and drives | Unencrypted copies of records leave company control | Collect or remotely wipe devices and log what was recovered |
| Shared links and API keys | Public links and integrations keep exposing data | Revoke sharing links, tokens and third-party app access |
Illustrative: a closed software company preserves its archives#
Illustrative: a fictional vertical software company stops operating after its product is discontinued. Its support history lives in Zendesk, engineering work in Jira and GitHub, and customer records in HubSpot. The board appoints the former CFO as wind-down officer by resolution.
The wind-down officer finds that the GitHub organization's only owner is a departed engineer and that the Zendesk plan renews soon. She asks each vendor's support team to restore owner access, using the board resolution as proof of authority, pays one more billing cycle and exports each system to encrypted storage with a custody log. Customer contracts are then checked: most allow the company to retain records, while a few require deletion at termination, and those customers' data is deleted with the deletion recorded.
The result is a documented archive the officer can present to creditors, an acquirer of the remaining assets or a licensing review, instead of a set of cancelled accounts nobody can reopen.
How SourceX approaches records in a shutdown#
SourceX starts with a metadata-only fit check, so a wind-down officer or trustee can describe systems, years of history and record types without sharing any files. That helps the person with authority decide what to preserve before subscriptions are cancelled.
If a license proceeds, the SourceX Evidence Packet records provenance and release authorization, including who signed for the company and under what authority, such as a board resolution or court order. Large archives stay in the company's own storage or ship on encrypted drives; SourceX does not host multi-TB datasets.
Frequently asked questions
Can a founder keep the company's data after it closes?
Not by default. The records belong to the company, and a founder needs an assignment, purchase or board-approved transfer to hold them personally. Even then, customer contracts and privacy notices may limit what can move to a new owner, so any transfer should be documented and reviewed by counsel.
What happens to customer data held under a data processing agreement?
Data processing agreements usually say what happens at termination, often requiring return or deletion of customer data. Those obligations generally survive a shutdown. Identify the affected customers, follow each agreement's terms and keep a record of what was returned or deleted and when.
How long should records be kept after closing?
There is no single answer. Tax, employment, litigation and industry rules set different retention periods, and pending disputes can extend them. Build a retention and deletion schedule with your accountant and counsel, and do not destroy records that are subject to a litigation hold.
Can a trustee license company data to pay creditors?
A trustee or assignee may be able to license or sell data assets while administering the estate, subject to the governing law, court approval where required and the privacy commitments the company made. Where a privacy policy limited transfers of personal information, a bankruptcy court may call for an independent privacy review before approving a sale. Rights in each record type still need review before any license is signed.
Should we export everything before cancelling systems?
Export broadly, then decide what to keep. A complete, verified export preserves options for creditors, litigation and licensing. Deletion decisions can follow once counsel confirms retention duties and customer obligations, which is safer than discovering a gap after a vendor has purged the account.
Related resources
- QuestionShould companies sell or license their data?
- QuestionData licensing vs data selling: what's the difference?
- InsightDo ABL lenders restrict a distributor from licensing its data?
- InsightWho has authority to license a dissolved company's data?
- InsightAcquiring a company that already licenses its data: what to check
- SolutionData licensing: granting defined rights to use your data
See if your company qualifies
A short company assessment. No data uploads are needed.