Click Cancel last. What to do with your data first.

Canceling a cloud subscription feels like ending a gym membership: stop paying, stop going. Except the gym isn’t holding six years of your invoices, customer history, and project files, and the cloud service is. Cancel in the wrong order and employees lose access before the business has a usable copy of any of it.

What happens after cancellation varies more than people expect. Some providers keep data retrievable by admins for a grace period; others restrict access or start deleting on a schedule. Microsoft walks ended Microsoft 365 subscriptions through defined lifecycle stages and tells customers to back up before deletion; Google tells Workspace customers to export first, and notes that third-party app data isn’t automatically cleaned up when you cancel. Billing may also run to the end of an annual term, and a subscription bought through a reseller cancels differently than one bought direct. Read the current terms for your service before you pick a date. Don’t rely on a general rule.

Export more than the obvious

Start with a blunt question: what does this service actually hold? Customer records, documents, attachments, email, calendars, invoices, tickets, project history, audit logs. The list is usually longer than anyone remembers.

Then distrust the standard export, politely. Exports commonly capture the main records while silently skipping attachments, comments, permissions, deleted items, automation rules, or activity history. Read the provider’s export documentation so you know what’s included, and request anything missing before access ends. Run the export from a business-owned admin account and store it somewhere the business controls, not one employee’s Downloads folder. Large exports take time to generate; start early enough to chase failures.

Test before you burn the bridge

A completed download is not a verified export. Open a sample of every file type. Check that attachments exist, dates survived, and records still connect to the customers and projects they belong to. CSV files are the classic trap: all the words and numbers, none of the relationships. Customers in one file, invoices in another, and nothing linking them.

If you’re migrating to a replacement system, import a small batch first and have the people who use the system daily confirm it looks right: names, custom fields, open tasks, history. Only then move the rest. All of this happens while the old service is still alive and can answer questions.

Follow the wires: integrations and sign-ins

Cloud services grow connections. Your website form feeds leads into it; your accounting software pulls invoices out of it; reports, payment notifications, and scheduled jobs quietly depend on it. List everything that sends data in or takes data out, including mobile apps, browser extensions, API connections, and automations, and repoint or retire each one before the account closes.

The sneakiest dependency is identity. If employees click “Sign in with Google” or “Sign in with Microsoft” using accounts tied to the service you’re killing, those downstream logins break with it. Add an alternative sign-in method first, confirm the business controls the admin and recovery details on every connected account, and revoke the old tokens and API keys once the move is done.

Mind your retention obligations

Some of what’s in that service, you’re required to keep: financial records, contracts, customer communications, consent records, for periods that depend on your industry and contracts. Check with your accountant or counsel before anything is deleted. Then document the move itself: what was exported, when, who verified it, where it lives, plus the cancellation confirmation and final invoice. Give the exported files their own retention period and a secure end-of-life.

Cancellation and deletion are two different events

Stopping payment is not the same as your data being gone. Ask the provider what happens to active data, deleted items, backups, logs, and billing records, and whether subcontractors hold copies. Data commonly ages out of backups on a slower clock than it leaves active systems, and providers may lawfully retain some records for billing or fraud purposes. For systems that held sensitive data, get the deletion confirmed in writing. The UK’s NCSC makes this a standing recommendation: contracts should spell out how data is returned or destroyed when a supplier relationship ends.

The order of operations

1. Name one owner and set dates with slack in them.
2. Inventory the data, the users, the integrations, and the sign-in dependencies.
3. Export with admin tools into business-controlled storage.
4. Test the files; pilot the import into the replacement.
5. Repoint integrations and move employees; test their daily work.
6. Cancel, and only now, keeping the paperwork.
7. Revoke old access and get deletion confirmed.

Whether the system being retired is a legacy CRM or an abandoned project platform, the pattern is consistent: the companies that struggle are the ones that clicked Cancel first and asked questions second. The reverse order costs a few weeks of patience and saves the data.