Section 542 turnover of debtor records to a trustee: electronic records and passwords
Section 542 requires whoever holds estate property to turn it over to the trustee, and section 521(a)(4) requires the debtor to surrender recorded information, including books and records. For electronic records, real turnover means access: the domain registrar, identity provider, cloud and email admin accounts and backup keys. Without them, no records assessment or license can start.
The short answer: turnover has to reach the access, not just the files
A debtor must surrender recorded information about estate property to the trustee, and anyone else holding estate property must turn it over. For a business that ran on cloud software, the records are useless without the accounts that control them: the domain, the identity provider, the email and cloud admin consoles and the backup keys. Courts and local rules differ on how expressly passwords are covered, so a day-one demand should name the credentials and devices, not just the records.
What sections 542 and 521(a)(4) say
In summary, and subject to the current text:
- Section 521(a)(4) requires the debtor, where a trustee is serving, to surrender all property of the estate and any recorded information, including books, documents, records and papers, relating to property of the estate.
- Section 521(a)(3) requires the debtor to cooperate with the trustee as necessary to let the trustee perform its duties.
- Section 542(a) requires an entity in possession, custody or control of property the trustee may use, sell or lease to deliver it and account for it, unless it is of inconsequential value or benefit to the estate.
- Section 542(e) lets the court, after notice and a hearing and subject to any applicable privilege, order an attorney, accountant or other person holding recorded information about the debtor's property or financial affairs to turn it over or disclose it.
Some districts' local rules expressly mention passwords or security codes; others say nothing, and requests are then framed around recorded information and the duty to cooperate. Read the statute and your district's rules with counsel before relying on this summary.
The day-one access demand list
| Access item | Why it matters | Who usually holds it |
|---|---|---|
| Domain registrar account | Controls the domain, and with it mail routing and account recovery for most other systems | Founder, IT lead or an outside web agency |
| DNS host | Mail and ownership-verification records live here | IT lead or managed service provider |
| Identity provider admin | One sign-on that reaches most business applications | IT lead or security engineer |
| Email and collaboration super admin | Mailboxes, chat, shared drives and retention settings | IT lead, office manager or provider |
| Cloud infrastructure root and billing | Databases, object storage and logs, plus the payment method that keeps them alive | CTO or engineering lead |
| Backup console and encryption keys | Often the only copy of older history | IT lead or backup vendor |
| Password manager admin and recovery kit | Holds many of the credentials above | IT lead and executives |
| Code repository organization owner | Source code, pull requests and issues | CTO or engineering lead |
| CRM, ERP and accounting admin | Customer, deal and finance history | Sales operations, controller, outside accountant |
| MFA devices and recovery codes | Credentials alone may not log in without them | Individual admins |
| Vendor billing contacts | Lets you stop auto-cancellation and deletion | Finance or office manager |
Turnover problems trustees run into
| Turnover problem | What to check | Usual next step to confirm with counsel |
|---|---|---|
| Former IT director will not hand over passwords | Whether they hold estate property or recorded information, and what the local rule says | Written demand, then a turnover motion if needed |
| Managed service provider holds credentials and claims unpaid invoices | Any lien or setoff it asserts, and the service contract | Negotiate interim access while counsel weighs a motion |
| Outside accountant holds the accounting file | Section 542(e) and any privilege | Request first, then a court order if refused |
| Company data sits on employees' personal devices or accounts | Which data belongs to the company and how to collect it without overreach | Targeted requests, ideally with forensic help |
| Vendor suspended the account for nonpayment | Reinstatement terms and the deletion schedule | Pay to reinstate if the screen suggests value, then export at once |
| Principals unresponsive or abroad | A Rule 2004 examination and contempt options | Counsel leads; preserve whatever you can reach meanwhile |
Outside bankruptcy, control of records moves through different channels, as in friendly foreclosures under Article 9.
Secure first, assess second
- Stop deletion. Pause scheduled cancellations, mail-purging retention policies and account deprovisioning.
- Take control. Add two trustee-controlled admin accounts, rotate shared credentials and log who changed what.
- Preserve. Export mailboxes, drives, CRM, tickets and repositories to storage the estate controls.
- Inventory. List each system, its years of history and what was exported, opening as few individual files as possible.
- Screen. Compare the company with the who qualifies baseline. It needs 50+ full-time employees at peak (contractors excluded), a multi-year operating record, records of its own making and a dataset not dominated by consumer or patient information. For a quick first pass, try the company fit checker; its result is preliminary and non-binding.
- Decide. Keep, license, sell or move to destroy; see motions to destroy debtor books and records.
If keeping systems alive requires short-term authority, section 721 operating orders can cover hosting and a few contractors.
Turnover gives access, not new rights
Control of the accounts does not erase what the debtor promised its customers. In a January 2024 staff post, the FTC said that a company's promises about how it will use customer data stay binding, including promises not to use that data to train or update AI models, whether the promise sits in a privacy policy, terms of service or marketing copy. Read the debtor's privacy policy and customer contracts before treating customer content as licensable. SourceX is interested in records of how the company itself operated; a dataset made up mostly of consumer personal information is a red flag.
Sample demand language
Good practice once you have access
- Keep an access log: who logged in, when and why.
- Review content only as far as the estate needs; for a records assessment, metadata and counts usually suffice.
- Send no records, samples or screenshots to anyone outside the estate. Redaction and de-identification terms are settled with SourceX up front, and delivery waits for a signed agreement and the trustee's go-ahead.
- Disclose any referral relationship before acting on it.
Referral rewards and the trustee's position
Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and rewards become payable only after the buyer pays and SourceX receives its fee. The reward is never taken from estate proceeds, and no reward is guaranteed.
Because trustee compensation is set through the court, a trustee who makes an introduction should not take a referral reward personally without counsel's sign-off and full disclosure. Professionals retained by the estate face the same check under their retention orders.
This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.
Next step
Send the access demand on day one, before accounts lapse. Advisors who regularly work alongside trustees can register as a partner to make introductions; the trustee is equally free to apply at sourcex.si/apply.
- Step 1Share your linkSend your personal link to a company you know.
- Step 2Company appliesThe company applies itself at /apply.
- Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
- Step 4You get your rewardYour share of SourceX fees becomes payable.
Common questions
Does a debtor have to give the trustee its passwords?
The statutes speak of surrendering estate property and recorded information and of cooperating with the trustee, and some districts' local rules expressly cover passwords and security codes. Where the rules are silent, counsel usually frames the request around those duties. Ask for credentials in writing early, and be ready to seek a court order if a former officer refuses.
Can a trustee read former employees' mailboxes?
The mailboxes sit in the company's tenant, so the trustee generally controls them, but privilege, personal messages and privacy promises still matter. Limit review to what the estate needs, keep an access log, and agree screening rules with counsel before anyone opens individual messages. For a records assessment, system metadata and counts are usually enough.
What if the cloud provider has already deleted the debtor's account?
Ask the provider in writing whether any data remains in a recovery or grace period and what reinstatement requires. If nothing remains, look for other copies: backup services, exports a former admin made, synchronized laptops or a service provider's archives. Records that are gone cannot be licensed, so document what was lost and move on.
Does turnover let the trustee license customer data?
No. Turnover gives the trustee control of what the debtor held, subject to the same contracts and privacy promises that bound the debtor. Customer content may be restricted by privacy policies, terms of service or confidentiality clauses. Business records about the company's own operations are the usual subject of a license, and counsel should review rights before any licensing discussion.
Should the trustee change every password on day one?
Change shared and privileged credentials quickly and add trustee-controlled admin accounts, but avoid mass resets that lock out the one person who knows how a system works. Coordinate with any cooperating former staff first, record each change, and make sure multi-factor recovery routes point to accounts the estate controls.
Related pages
- Friendly foreclosure under Article 9: which records move to the lender's newco?
- Which US businesses are a fit for a SourceX data licensing introduction
- Check Company Fit for Data Licensing
- Motion to abandon and destroy books and records: what to check before you file
- Can a chapter 7 trustee operate the business under section 721?
Free resources
- Days sales outstanding calculator — How many days customers take to pay.
- Business succession planning assessment — Ten questions on successor, transition and documentation.
- NPV calculator — Net present value with a discounted cash flow table.
- All free tools · MCP resource center
By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09
Know a US company with valuable proprietary data?
Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.
Refer a company →I own a business
Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.
Start an assessment