A deletion certificate is only the start of a vendor closeout
Share
Published
A vendor deletion certificate can be useful evidence, but its value depends on what it covers. Before closing the supplier record, check the service, systems, dates, exceptions and authority behind the statement.
This checklist supports the vendor exit plan. It is an operational review of evidence, not a standard legal certificate or a conclusion that a supplier has met every contractual obligation.
Identify the material covered
Match the certificate to the customer account, service and information categories involved in the exit. “All data deleted” is difficult to assess if the statement does not identify the scope or distinguish the application from other records held by the supplier.
Ask whether the statement covers active systems, exported working copies, support attachments, logs and any relevant subcontractors. Record the answer without assuming all these categories have the same retention or deletion process.
Check dates and responsibilities
| Item | Question |
|---|---|
| Scope | Which account, service and information are covered? |
| Completion date | When was the stated action completed? |
| Authority | Who issued the statement and in what capacity? |
| Method | What action was performed, at an appropriate level of detail? |
| Exceptions | What remains, why, and under which restriction? |
| Follow-up | Who answers questions or confirms a later disposal step? |
Do not ask the supplier to place credentials or unnecessary customer information in its evidence. The objective is an accountable description of handling, not another copy of the underlying records.
Understand retention exceptions
Some material may be subject to a documented legal or contractual retention requirement. The review should establish the reason, duration or review trigger, access restrictions and disposal process. A vague claim that records are needed “for compliance” leaves too much unresolved.
Backups may also follow a different lifecycle from active application data. Ask how the supplier handles deletion in that environment and what prevents a routine restoration from reintroducing material outside the agreed process. Avoid promising a technical outcome the supplier has not confirmed.
Separate access removal from deletion
A former user being unable to sign in does not establish that stored information was deleted. Similarly, deleting the application record may not revoke a connection configured in another system.
Check user access, shared links and integrations as separate closeout tasks. If an assistant had access to the service, review the relevant AI permission-register entry and the status of its connection.
Include the business’s own copies
The supplier’s certificate does not settle what happens to exports downloaded by your staff. Review test files, migration copies and attachments created during the exit. Keep what the organisation is entitled and required to retain, under the appropriate controls, and deal with unnecessary copies through its disposal process.
The export-test checklist helps identify those copies before they become a forgotten archive.
Do not apply one device-erasure claim everywhere
NIST’s 2025 media-sanitisation guidance addresses methods and controls suited to media and information sensitivity. A statement about a particular drive-erasure method should not be treated as an explanation of every cloud-service deletion process.
For leased equipment, identify the actual device and applicable manufacturer process. Retain evidence appropriate to that equipment and the agreed responsibilities.
When can the supplier record close?
Close it when the responsible owner has reviewed the evidence, recorded any accepted exception and assigned outstanding actions. A disputed or incomplete statement should remain an open item with a next step. Preserve the certificate and review decision under the organisation’s relevant retention rules.
Featured image: AI-generated conceptual illustration.
