The Subscription Ended. The Access Didn't: A SaaS Exit Check for Small Teams

There is a satisfying little moment when you cancel a software subscription. The invoice stops. The renewal email dries up. Someone in the team says 'right, that's that sorted'. And then, six months later, you find the old tool is still sitting there with a live integration, a shared admin login and a copy of your customer list.

Cancelling is not the same as closing. For small UK teams without a dedicated IT function, that difference matters. Tool offboarding deserves the same discipline we already give to staff leavers and supplier breakups. Not because anyone is being dramatic, but because access has a habit of outliving the contract.

Why the cancel button is not a security control

Most SaaS billing portals are designed to stop money leaving your account. They are not designed to prove that data has gone, integrations have been severed or admin rights have been removed. A tool can sit in a 'cancelled' state for months, still holding exported files, still accepting sign-ins from old users, still connected to your email platform through an OAuth grant nobody remembers approving.

Under UK GDPR, you need to be able to show that you have thought about what happens to personal data when a service ends. That does not mean a fifteen-page data protection impact assessment for every £12-a-month tool. It does mean knowing where the data went, who could still reach it and when you asked for it to be deleted. Accountability is mostly a paper trail, not a personality trait.

The ten-minute pre-flight

Before you click cancel, take ten minutes to work out what you are actually walking away from.

• Find the account owner. It is usually the person who signed up, not the person who uses it most.
• Check who has logged in during the last ninety days. If it is nobody, that is a useful clue.
• Look for integrations. Calendar sync, email sync, Slack apps, Zapier connections, webhooks and API keys are the usual suspects.
• Note the billing method. A team card is easy to forget and hard to explain later.
• Decide what needs exporting. Some tools delete data quickly; others keep it in a read-only vault until the end of time.

If the tool holds client files, HR records or anything that looks like personal data, treat the export as the important bit. A CSV is not glamorous, but it is evidence.

The thirty-minute exit check

Block half an hour. Put it in the calendar as 'SaaS exit: [tool name]' so future-you knows it happened. Then work through this.

1. Export first, cancel second (5 minutes)

Download the data you need in a format you can actually open. Check that the export includes owners, dates and any notes, not just a list of filenames. Store it somewhere controlled, not in someone's personal Downloads folder.

2. Record the current setup (3 minutes)

Take screenshots of the admin user list, connected apps and billing page. If a supplier later asks what you meant by 'remove our data', you will have a starting point. This is dull. It is also the bit that saves an argument.

3. Revoke integrations and tokens (5 minutes)

Go into the tool's settings and disconnect anything that points at your email, calendar, file storage or chat. Then go to the other end where you can. If the app appears in your Google Workspace or Microsoft 365 connected apps list, remove it there too. Revoking on one side only is like cancelling the milk but leaving the front door open.

4. Remove people and transfer ownership (5 minutes)

Delete old users, especially shared admin accounts. If the tool requires an owner, transfer it to a named person on a company email address, then close the old route. Do not leave the account anchored to a personal address belonging to someone who left in 2023.

5. Cut the payment details (3 minutes)

Remove stored cards where the portal allows it. Cancelling the subscription is good; leaving a live card on a dormant account is less good. Check the next invoice date and note it in your diary.

6. Ask for deletion in writing (4 minutes)

Send a short email to the supplier. Ask them to confirm when personal data will be deleted, whether it sits in backups, and what confirmation you will receive. Keep the reply. If they have a data processing agreement, this is the moment to use it.

7. Log the exit (5 minutes)

Add the tool to a simple exit register: tool name, owner, data exported, integrations removed, deletion requested, confirmation received, date closed. One spreadsheet is enough. It also helps when an insurer or client asks how you manage third parties.

The integrations are the sneaky bit

OAuth grants and API keys are designed to keep working quietly. That is the point of them. A marketing tool can keep reading your mailbox long after the invoice stops. A project app can keep pulling files from your shared drive because nobody revoked the connection.

When you retire a tool, check both ends of every connection. Look in the admin console of your main platform for connected apps. Search your password vault for the tool's name. Ask the person who set it up, if they are still around, what it talked to. Then write down what you found.

What to ask the supplier

You do not need a legal letter. A short, polite email works:

'We cancelled our subscription on [date]. Please confirm the date our workspace and associated personal data will be deleted, whether any data is retained in backups, and how you will confirm deletion to us. Please also confirm any subprocessors that held data for this service.'

If they reply with a help centre link, reply once more and ask for a specific date. If they go quiet, record that too. The point is not to win the exchange. The point is to have a record.

The underdog version

No helpdesk? No problem. One person, a calendar block and a shared spreadsheet will get you most of the way. If two people can do it together, even better: one drives, one checks the integrations list. The goal is not a perfect exit. The goal is a documented one.

Cancelled is not closed

The subscription ending is the easy part. The access ending is the work. Give every departing tool the same courtesy you would give a departing member of staff: remove the keys, collect what matters and write down that you did it. Your future self, your insurer and anyone asking about UK GDPR accountability will thank you.

Underdog Security is about practical defence for smaller teams. This is exactly that: thirty minutes, a checklist and one less forgotten login sitting in the corner.