When the Cloud Falls Silent: Protecting Your Business Records From SaaS Insolvency

The modern UK business runs on subscriptions. Bookkeeping sits in the cloud, customer pipelines live in a CRM, payroll is processed by a third-party platform, and project files reside on remote servers owned by companies the client has never met. This model is efficient, scalable and — until something goes wrong — largely invisible.

The something that goes wrong is rarely a security breach. It is insolvency. And when a SaaS provider enters administration, the practical consequences for customers are far messier than most directors imagine.

The Contractual Reality Behind the Marketing

Most SaaS agreements promise availability percentages and support response times, but few address the scenario that actually matters: the provider ceasing trading. Standard terms often state that data will be returned "on request" in an agreed format — language that carries little weight when the staff who would fulfil that request have been made redundant.

Insolvency practitioners are bound by duties to creditors, not to customers of the failed business. Data retrieval, migration assistance and export tooling are all costs with no obvious revenue. In several recent UK provider failures, customers have had weeks rather than months to extract their information, often through portals never designed for bulk export.

There is also a legal dimension. Under UK GDPR, a controller remains responsible for personal data even when its processor fails, and the Information Commissioner's Office has made clear that controller obligations do not pause because a vendor has collapsed. A business that cannot produce or secure its own customer records may find itself answering for the vendor's failure.

What Due Diligence Should Look Like Before You Sign

The time to interrogate a SaaS provider's resilience is before onboarding, not during its death throes. Directors should ask a small number of pointed questions:

• Where is the data held, and in what format? Proprietary formats that only the vendor's software can read are a red flag.
• Is there an escrow arrangement? Source code and data escrow agreements, though imperfect, provide a defined route to continuity.
• What are the exit terms? A contract specifying export formats, timescales and assistance obligations is worth more than any uptime guarantee.
• How financially stable is the provider? Filed accounts at Companies House tell you more than a sales deck. A company posting sustained losses while holding your financial records deserves scrutiny.

For business-critical platforms, these questions should be revisited annually. A vendor that was sound three years ago may be burning cash today.

Building Practical Redundancy

Beyond contract, resilience is operational. Businesses should maintain regular exports of critical data in open formats — CSV for records, PDF for documents — held on infrastructure the business controls. This need not replicate the entire platform; it needs to cover what would be genuinely catastrophic to lose: statutory accounting records, which company law requires directors to keep and preserve, customer contracts, and employee data.

Mapping dependencies is equally important. Many firms discover during a provider failure that a single subscription quietly underpinned email, invoicing and file storage simultaneously. Untangling that web mid-crisis, without the vendor's support, is expensive and slow.

Finally, test the exit. A dry run of data extraction — timed, documented and reviewed — converts a theoretical risk into a known, manageable process. It also reveals whether the vendor's export tools actually work, a fact better learned on a quiet Tuesday than during an administration.

A Governance Issue, Not an IT Issue

Too often, SaaS dependency is treated as a technical concern delegated to whoever manages the software. In truth, it is a governance matter. The loss of statutory financial records, the inability to evidence contracts, and regulatory exposure for mishandled personal data all land on the board.

Cloud computing has delivered genuine gains for UK businesses, and few would advocate returning to on-premise servers. But efficiency should not be mistaken for safety. The provider's failure is not a question of if, across a portfolio of vendors and a span of years, but when. The businesses that weather it will be those that treated their data as an asset they own — not a service they rent.