The SaaS exit plan: build it before you need it

On July 16, 2026, OneTrust published the retirement FAQ for Tugboat Logic, the product it also calls Certification Automation. Renewals ended on August 31, 2026, standard support ends on August 31, 2027, access stops when the subscription ends, and customers have 60 days after their contract expires to retrieve their data. No extended support is offered. This is neither a bankruptcy nor an incident: it is a product decision, and any SaaS supplier can make one. The time to prepare the exit is when the contract is signed, not when the announcement arrives.

What the sources say

DORA. Regulation (EU) 2022/2554, which has applied since January 17, 2025, is the most precise text on exit. Its Article 28(8) states: "For ICT services supporting critical or important functions, financial entities shall put in place exit strategies." Those strategies take into account a failure of the provider, a deterioration of the service, a business disruption or a termination. The entity must be able to exit without disruption to its business activities, without limiting compliance with regulatory requirements and without detriment to the services it provides to clients. Exit plans "shall be comprehensive, documented" and sufficiently tested and reviewed periodically. Transition plans must make it possible to remove the services and the relevant data from the provider and to "securely and integrally transfer them" to alternative providers or back in-house.

Article 30 turns this into clauses. For every ICT contract: access, recovery and return of data "in an easily accessible format" in the event of insolvency, discontinuation of business operations or termination (paragraph 2, point (d)), and termination rights with related minimum notice periods (point (h)). For critical or important functions, exit strategies are added, "in particular the establishment of a mandatory adequate transition period" during which the provider keeps delivering the service (paragraph 3, point (f)).

OSFI Guideline B-10. The Third-Party Risk Management Guideline, dated April 30, 2023, defines an exit plan as a series of actions to take in a planned or unplanned exit, along with the triggers for invoking it. In section 2.3.5.1, for critical or high-risk arrangements, it asks for a stressed-exit playbook, a non-stressed-exit playbook, a reference to contractual provisions "such as notification requirements and provisions obliging the third party to provide services over a prescribed period of time following notification of termination," and enough detail (alternative providers, timelines, costs, resourcing, interim workarounds) for rapid execution. For default and termination clauses, it requires appropriate notice and the return of data and records "in a format that allows the FRFI to sustain business operations without unreasonable expense." It stays proportionate: an exit plan may not be needed for a low-risk arrangement.

Why it matters

Both texts target financial entities, but they describe what any organisation should know about its SaaS suppliers: how long the service continues after an end notice, in what form the data comes back, how long it stays available, and what remains at the supplier afterwards.

The Tugboat Logic case shows the most common exit: planned, but on the supplier's timeline. A 60-day window after expiry is enough to download files. It is not always enough to check that an export is complete, load it somewhere else and confirm nothing is missing, especially when the data is audit evidence whose dates matter.

Deletion is the most often forgotten point. DORA speaks of removing data from the provider; neither DORA nor B-10 names a deletion attestation. Yet it is the only way to close the file: knowing when production data and backups will be gone, and having it in writing.

What we think at Sentrix

1. Classify each SaaS supplier before writing its plan. B-10's proportionality and DORA's notion of a critical or important function tell you where the effort belongs. The third-party risk module keeps that classification on the supplier record.
2. Require a documented export format, and test it. Open formats, with metadata: dates, authors, links between objects. An export that has never been reloaded somewhere else is not a plan.
3. Write the transition period and post-termination retention in days, with the obligation to keep the service running during the transition, as Article 30 of DORA requires.
4. Ask for a written deletion confirmation, covering production data and backups, with the backup purge delay.
5. Set a minimum notice period for termination and for a product's end of life. The OSFI guideline makes it part of the plan; a retirement notice should leave you at least enough time for a tender.
6. Keep the plan in the supplier register, with the date of the last test and the triggers. Our article on the DORA register of information shows how these fields connect.

The next step

Take your three most critical SaaS suppliers and answer in writing, for each: notice if the product ends, length of the transition, export format, retention period after termination, deletion confirmation. Every empty box is a clause to negotiate at the next renewal. To run the exercise with us, contact us.