Who owns and can recover our records when a SaaS vendor shuts down or we switch providers?

When records live in a cloud or SaaS system, two questions matter most: who owns the records, and how can you get them back intact? Both are governance questions you should answer before you sign a contract, not after a vendor announces it is shutting down.

Ownership Is Set by Your Contract, Not the Platform

In nearly every well-drafted arrangement, the organization that creates or controls the records remains the legal owner of that information. The vendor merely hosts and processes it. But that principle only protects you if it is written down. Review your service agreement for clear language stating that:

• Your organization retains full ownership of all data and metadata.
• The vendor has no right to retain, reuse, or sell your content.
• You can export your records, in usable formats, at any time and at termination.

If a contract is silent on ownership or export, you are exposed. Custody of the files is not the same as legal control, and a hosting relationship should never quietly transfer either.

Plan for Recovery Before You Need It

Vendors fail, merge, or get acquired, and you will sometimes choose to switch on your own terms. A sound exit strategy treats recoverability as a standing requirement:

• Export rights and formats. Insist on open, non-proprietary export of records, metadata, audit trails, and retention/disposition data. A proprietary-only export can strand you.
• Notice and transition periods. Require advance notice of discontinuation and a defined window to retrieve everything.
• Independent copies. Keep periodic exports or backups outside the vendor’s environment so a sudden shutdown does not erase your only copy.
• Chain of custody and integrity. Verify that recovered records remain authentic, complete, and readable, with their context preserved.

Governance Keeps Records Trustworthy Through the Move

Migrating providers is also a records event. Confirm that retention schedules, legal holds, and disposition rules carry over, and document the migration so the recordkeeping history stays defensible. Standards for managing records in digital environments emphasize maintaining authenticity, reliability, and usability across system changes — exactly the qualities a vendor transition can threaten.

Treating ownership and recoverability as contractual and procedural controls, rather than vendor promises, is the heart of sound information governance.