Systems and records
Who controls company software accounts in an ABC, receivership or bankruptcy?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Control of company software accounts follows legal authority over the company's assets: the assignee in an ABC, the receiver within the appointment order, the trustee in Chapter 7, and usually the debtor in possession in Chapter 11. Authority is not access, so the fiduciary's first task is taking over admin roles before subscriptions lapse.
Key takeaways
- Authority over software accounts follows the legal process: assignee, receiver, trustee or debtor in possession, as set by the governing documents.
- The person holding the admin password is often a former employee, a founder or a managed service provider, not the fiduciary.
- Secure the domain registrar and identity provider first, because control of email and sign-in controls password resets everywhere else.
- Suspend departed users instead of deleting them, since deletion in many systems destroys records creditors may need.
- Vendor rights to suspend or terminate service after an insolvency event are assessed with counsel under the process that applies.
Who has authority over software accounts in each process?#
Authority over company software accounts belongs to whoever controls the company's assets in the process that applies, and the governing document says how far that control reaches. The accounts are usually contract rights under subscription agreements, and the records inside them are company property, so both follow the company into the process.
The table is a starting map, not a legal conclusion. State law governs ABCs and many receiverships, appointment orders vary widely, and a Chapter 11 case can change hands if the court appoints a trustee.
| Process | Who usually controls company assets | Where authority is written | What to confirm |
|---|---|---|---|
| Out-of-court wind-down | Board and officers, sometimes a designated wind-down officer | Board resolutions and officer appointments | Who may sign vendor changes and approve data decisions |
| Assignment for the benefit of creditors (ABC) | The assignee | The assignment agreement, under state law | Whether contract rights and records were included in the assigned assets |
| Receivership | The receiver, within the court's order | The appointment order | Whether the order reaches digital systems, records and vendor contracts |
| Chapter 7 bankruptcy | The Chapter 7 trustee | The Bankruptcy Code and court orders | Which accounts the trustee needs to keep running, and until when |
| Chapter 11 bankruptcy | Usually the debtor in possession, unless a trustee is appointed | The Bankruptcy Code, first-day orders and later orders | Which actions need court approval, such as sales outside the ordinary course |
Why admin access is not the same as authority#
Admin access is a practical fact about who holds the passwords, and in a distressed company it rarely matches legal authority. The Google Workspace super admin may be a departed IT manager. The AWS root login may route to a founder's personal email. The managed service provider may hold the only Microsoft 365 global admin credentials and be owed money.
Those gaps carry real risk. A former insider can delete a workspace, an unpaid provider can withhold credentials, and a cancelled payment card can trigger suspension and, under many vendors' terms, later deletion. Closing the gap between authority and access comes before any discussion of what the records are worth.
- Domain registrar and DNS host: whoever controls these controls email delivery and most password resets.
- Identity provider: Google Workspace super admin, Microsoft 365 global admin or an SSO tool such as Okta.
- Cloud infrastructure: root or owner accounts for AWS, Azure or Google Cloud, plus the billing account.
- Code and engineering: GitHub or GitLab organization owners, and Jira and Confluence site admins.
- Customer systems: Salesforce, HubSpot, Zendesk or a field service platform such as ServiceTitan.
- Finance: accounting, payroll and banking portals, and the password manager that holds everything else.
First-week steps to secure admin access#
In the first week, the fiduciary's priority is control of admin access, not cleanup. Each step below either preserves a record or moves an owner-level role to the fiduciary or to someone the fiduciary designates in writing.
Log every change: who made it, when, and under what authority. That log protects the fiduciary if a former officer or a creditor later questions how the records were handled.
- Step 1: keep copies of the assignment agreement, appointment order or bankruptcy orders ready to send to vendors.
- Step 2: build an account register from card statements, accounts payable, the SSO dashboard, the password manager and billing emails.
- Step 3: take over the domain registrar and identity provider, then reset recovery emails and phone numbers to fiduciary-controlled contacts.
- Step 4: add the fiduciary's designee as owner or admin in each core system, then remove admin rights from departed staff.
- Step 5: suspend departed users rather than deleting them, and switch on retention or holds where the plan supports them.
- Step 6: record each subscription's renewal date, payment method, export options and data deletion terms.
- Step 7: tell key vendors in writing who now holds authority, who the billing contact is and who may request exports.
What can vendors do after a filing, assignment or appointment?#
Vendor rights after an insolvency event depend on the subscription terms and on the process that applies, and they are a question for counsel. Many software agreements allow suspension for nonpayment and termination on insolvency. In bankruptcy, the automatic stay and the rules on executory contracts may limit some vendor actions; in an ABC or receivership, state law and the court's order shape the answer.
The practical response is similar in every process: decide which subscriptions must stay live to preserve records, keep those current for as long as needed, and get complete exports before any termination takes effect. Read the termination and data deletion clauses closely, because some vendors delete customer data soon after an agreement ends.
| Vendor action | What to check | Practical response |
|---|---|---|
| Suspension for unpaid invoices | Notice terms, and whether older unpaid invoices can be the basis | Pay for continued access where records are at risk, after counsel review |
| Termination on insolvency | Insolvency or ipso facto clauses and how the process treats them | Ask counsel before accepting a termination |
| Deletion after termination | Grace period and export rights in the agreement | Export and verify before the termination date |
| Change of admin or billing contact | The vendor's verification process | Send authority documents and name a designee |
| Refusal to recognize the fiduciary | The vendor's account-verification and legal-request process | Escalate with the authority documents; ask counsel whether a court order or letter is needed |
Who decides what happens to the records inside the accounts?#
The fiduciary decides what happens to the records inside the accounts, subject to the duties of the process and any approvals it requires. Assignees and trustees generally act for the benefit of creditors, and a receiver acts as an officer of the court within its order, so preserving records that have value, including value through licensing, can fit within the mandate.
Limits still apply. Customer contracts may restrict use of customer data, privacy policies may have made promises about personal information, and in bankruptcy a sale or license outside the ordinary course may need court approval. A license, where the estate grants a defined use and keeps ownership, can be easier to fit within those limits than an outright sale, but that is assessed case by case with counsel.
Illustrative: an assignee inherits a software company's stack#
Illustrative: a fictional maker of maintenance scheduling software for commercial property managers closes and makes an assignment for the benefit of creditors. The assignee receives a subscription list from the former controller, but no passwords.
The register shows that the Google Workspace super admin is the departed CTO, the GitHub organization is owned by the founder's personal account, and Zendesk and Jira renew shortly on a card that has been cancelled. The founder cooperates and transfers organization ownership, and the assignee uses the assignment agreement and domain control to verify its authority with Google.
The assignee keeps Zendesk, Jira and GitHub current long enough to export full histories, suspends former staff in Google Workspace instead of deleting them, and cancels tools that hold nothing of value. With the records secured, the assignee and counsel can weigh whether licensing the support and engineering history would add value for creditors.
How SourceX works with fiduciaries#
SourceX works with whoever holds legal authority, and that person approves each stage of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The fit check runs on metadata, such as which systems exist and how much history remains, so nothing leaves the estate's control during assessment.
For a package that proceeds, the SourceX Evidence Packet ties release authorization to the assignment, order or resolution that empowers the signer, and also records provenance, licensing rights, permitted use and the privacy record. Large datasets stay in the estate's own storage or ship on encrypted drives.
Frequently asked questions
Can a former officer still make changes to vendor accounts?
A former officer may still have working credentials, but in most processes they no longer have authority to act for the company. The fiduciary should remove their admin rights, tell vendors who now holds authority, and document any changes the former officer made after the process began.
Should we delete departed employees' accounts to cut license costs?
Not before checking what deletion destroys. In many systems, deleting a user removes their mailbox, files and history after a short window. Suspending users, moving them to archive licenses or applying holds usually preserves records at lower risk. Cancel unused tools, but keep systems that hold records until they are exported.
Does a trustee or assignee need approval to license the company's records?
It depends on the process. In bankruptcy, transactions outside the ordinary course often need court approval, and personal data can add further review. In an ABC or receivership, the assignment agreement, state law and the court's order govern. Counsel should confirm the path before terms are discussed.
What if a managed service provider will not hand over credentials?
Start with the authority documents and a written request naming each account. Many platforms let a verified domain owner or billing owner recover admin access directly from the vendor, which can bypass a provider that is holding out. Disputes over unpaid fees are handled by counsel, separately from regaining access.
Which systems hold the records worth preserving first?
After the domain and identity provider, prioritize systems whose history cannot be rebuilt: help desk, CRM, engineering tools, ERP and accounting. Cloud storage and file shares come next. Marketing tools and single-purpose apps can usually wait or be cancelled once their contents are checked.
Related resources
- InsightDoes licensing company data need lender consent under a credit agreement?
- InsightLender consent before licensing company data: what credit agreements say
- InsightDoes a secured lender's lien cover data licensing revenue?
- QuestionWho owns enterprise data?
- QuestionCan SaaS data be licensed?
- IndustryLegal data
See if your company qualifies
A short company assessment. No data uploads are needed.