Start for free Start for free

Vendor Offboarding

Vendor offboarding is what you do when you stop using a vendor: export your data, have the vendor delete what it holds, remove its access to your systems and update your records.

What is vendor offboarding?

Vendor offboarding is what you do when you stop using a vendor: get your data out, make sure the vendor deletes what it holds, remove its access to your systems and close the record. It is the last step of vendor risk management, and the one most often skipped.

NIST's Cybersecurity Framework asks that plans cover "activities that occur after the conclusion of a partnership or service agreement" (GV.SC-10). The SOC 2 points of focus include procedures for ending vendor relationships. The US bank guidance names the same risks: "data retention and destruction, information system connections and access control".

A simple offboarding flow:

  1. Check the notice period and cancel in time, so you are not renewed for another term.
  2. Export your data in a format you can use. See data export and portability.
  3. Remove access: single sign-on, API keys, integrations and any accounts the vendor had in your systems.
  4. Ask the vendor to delete your data and confirm it in writing.
  5. Update your vendor inventory and, if the vendor handled customer data, your own subprocessor list.

A real change we caught

Deletion after you leave is not always quick. Venpo flagged that StreamYard can now keep personal data for three years after you leave. Its October 2026 data processing addendum sets deletion at three years after your last use or the end of your subscription, where the old one tied deletion to your written instruction. If you offboarded assuming your data was gone, the vendor's current terms may say otherwise.

Why it matters to you

Leaving a vendor does not end what it holds. Many DPAs allow exceptions to deletion. Atlassian's DPA, for example, lets it keep data where the law requires or under its "standard backup or record retention policies". That data is still covered by your promises to customers until it is gone.

Forgotten access is the other risk. An API key or integration left in place keeps sending data to a tool nobody watches anymore.

What to check

  • The data deletion after termination clause in the DPA or terms: how many days, and what exceptions.
  • How long the export window lasts after the contract ends.
  • Whether you can get written confirmation of deletion.
  • Every integration, API key and connected account linked to the vendor.
  • Whether your customers need notice that a subprocessor was removed.

How Venpo helps

Venpo's Fine Print Scan answers how long each vendor keeps your data, so you know before you leave what to expect. While you are still a customer, Venpo emails you a plain-English alert if the vendor changes its retention or deletion terms.

Start for free

Frequently asked questions

How do I make sure a vendor deleted my data?

Ask for written confirmation of deletion and check the DPA for the deletion deadline and any exceptions, such as backups. Keep the confirmation with your vendor records.

Do I need to tell my customers when I stop using a vendor?

If the vendor was on your own subprocessor list, update the list. Check your customer DPAs for any notice you promised.

When should I start offboarding a vendor?

Before the cancellation deadline in its contract, not after. Starting early gives you time to export data while you still have full access.

Related terms

How Vendors Use Your Data Data Deletion After Termination Data deletion after termination is what a vendor does with your data when your contract ends: usually a short window to export it, then deletion from live systems, with backups removed later. How Vendors Use Your Data Data Export and Portability Data export and portability is your ability to download your data from a vendor in a usable format, such as CSV or JSON, so you can keep it or move it to another tool. Vendor Management Vendor Onboarding Vendor onboarding is the set of steps you take when you start using a new vendor: checking its risk, accepting its terms, setting it up safely and adding it to your vendor list with an owner. Renewals, Pricing and Billing Notice of Non-Renewal A notice of non-renewal is the message you send a vendor to say you will not renew when your current term ends. Contracts often require it a set number of days before the end date, and missing that deadline can lock you into another term. Vendor Management Vendor Lock-In Vendor lock-in is when leaving a vendor would cost so much time, money or data that you stay even when you would rather go. It usually comes from data you cannot easily export, long commitments and workflows built around one tool. Vendor Management Vendor Inventory A vendor inventory is one list of every company you buy from, with an owner, the data it handles, its risk tier, links to its legal documents and its renewal date. It is the starting point for managing vendor risk and for a SOC 2 audit.

Sources

Last reviewed