Who Owns Your Business Data? Ownership, Portability and Exports

Every time you add customers, notes, call recordings and invoices to a software platform, you are building an asset. The question most businesses never ask until it is too late is simple: if you leave, or the provider leaves you, what do you get back?

"Ownership" of business data is less about a single legal label and more about practical control. Can you access it, export it, move it and delete it on your terms? Those answers live in the service agreement and in the product's export features, not in the sales pitch.

This guide covers what to check before you commit. It is general information, not legal advice; for contract terms that matter to your business, talk to a lawyer.

Ownership versus control

With software as a service, NIST's definition, SP 800-145, notes that the customer "does not manage or control the underlying cloud infrastructure." The provider runs the servers, storage and application. Your rights to your data are whatever the agreement grants, plus whatever the law requires.

NIST's cloud computing synopsis, SP 800-146, adds a realistic note: "for the typical consumer, however, a cloud's pricing policy and service agreement are nonnegotiable." That makes reading the standard terms more important, not less, because you are choosing between providers' terms rather than negotiating your own.

What to look for in the terms

Read the terms of service, privacy policy and any data processing agreement with these questions in mind:

• Ownership: does the agreement say you own the content and customer data you put in?
• License to the provider: what rights does the provider take to use your data, for example for analytics, product improvement or training AI models, and can you opt out?
• Return of data: what does the provider commit to when the contract ends, in what format and for how long?
• Deletion: when and how is your data deleted after you leave, including backups?
• Suspension: what happens to your data if an invoice is missed or the account is suspended?
• Changes: can the provider change these terms, and how are you notified?

That suspension point deserves attention. In its 2012 review of standard cloud service agreements, NIST observed that if access is terminated for cause, such as nonpayment, "most providers state that they have no obligation to preserve any consumer data remaining in cloud storage." Terms vary and have changed since, which is exactly why you should check yours.

The U.S. Digital Service's Digital Services Playbook, written for government buyers, offers a useful model clause: the contract "specifies that software and data generated by third parties remains under our control." Small businesses rarely get custom contracts, but you can still favor providers whose standard terms say something similar.

Portability: what a usable export looks like

An export button is not the same as portability. NIST SP 800-146 warns that "formats for exporting and importing data may not be fully compatible" between software-as-a-service products, and that customized workflows, settings and add-ons "can also be provider specific and not easily transferable."

Before you commit, confirm that you can export:

• All record types, not just contacts: companies, deals, notes, tasks, appointments, invoices and payments.
• History: call logs, message threads and email activity, with dates and who handled them.
• Files: attachments, documents and call recordings.
• Relationships: record IDs that show which notes, deals and invoices belong to which customer.
• In common formats such as CSV or JSON, in bulk, without a support ticket.
• Through an API, if you will need ongoing copies or a large migration.

Some things will not move, such as automation rules and custom reports. Document them as you build so they can be recreated elsewhere.

Your customers' data is still your responsibility

Using a platform does not hand off your obligations to customers. The FTC put it plainly in its guidance on cloud security: "if it's your data, it's ultimately your responsibility."

Privacy laws can reinforce this. The California Attorney General's summary of the California Consumer Privacy Act explains that consumers have rights to know, delete and correct personal information, among others, and that "it is the business that is responsible for responding to consumer requests," not its service providers. Whether the CCPA applies to you depends on thresholds in the law, but the practical point is general: you need to be able to find, export and delete a specific person's data across every system you use.

Test the exit before you commit

NIST SP 800-146 recommends that buyers "plan also for an eventual termination of a provider's service during the procurement phase of the contract, and should clarify how assets are to be returned." In practice:

1. During the trial, load realistic sample data, then run a full export.
2. Open the export and check it is complete, readable and keeps record relationships.
3. Note anything that cannot be exported, and decide whether you can live with that.
4. Once live, schedule a regular export and store it somewhere you control.
5. Keep a written list of automations, templates and settings you would need to rebuild.

A note for agencies and resellers

When an agency or reseller sets up software for a client, ownership gets a third party. Put it in writing: whose account holds the data, who can export it, and what the client receives if the relationship ends. For example, imagine a marketing agency that manages a dental practice's CRM under the agency's account. If the engagement ends, the practice should be able to take its patient contact history with it, and both sides should know in advance how that happens.

Key takeaways

• With software as a service, your practical rights to your data come from the service agreement, so read it before you commit.
• Check ownership, provider usage rights, return of data, deletion and what happens on suspension.
• Portability means complete, bulk exports in common formats that keep record relationships, not just a contact list.
• You remain responsible for your customers' data, including responding to privacy requests where laws apply.
• Test a full export during the trial and schedule regular exports once you are live.
• Agencies and clients should agree in writing who controls the data and how it is handed over.

Sources

• National Institute of Standards and Technology, SP 800-145: The NIST Definition of Cloud Computing (September 2011)
• National Institute of Standards and Technology, SP 800-146: Cloud Computing Synopsis and Recommendations (May 2012)
• U.S. Digital Service, Digital Services Playbook
• Federal Trade Commission, Six Steps Toward More Secure Cloud Computing (June 15, 2020)
• State of California Department of Justice, Office of the Attorney General, California Consumer Privacy Act (CCPA)