MSP going out of business: what happens to client data and the MSP's own records

Whose data is it when an MSP goes out of business?

Client data belongs to the clients. Everything inside a client's tenant, servers, backups, mailboxes and line-of-business applications goes back to that client, or is destroyed on its instructions, under the offboarding terms of each master services agreement. What may remain licensable is the MSP's own operating history: internal tickets, runbooks, project records and the decisions its staff documented while running the business.

Between those two sits a large grey zone. Service tickets and documentation entries are written by MSP technicians in the MSP's own tools, but they describe client environments and often contain client confidential information. Whether any of that can be licensed depends on the contracts, not on who typed it.

For the third bucket, ownership is usually clear. Under US copyright law, material an employee prepares within the scope of the job is generally a work made for hire owned by the employer, as the Copyright Office explains in Circular 30. Runbooks written by 1099 technicians or subcontractors are different: the MSP may not own them unless the rights were assigned in writing.

What records a mature MSP holds

An MSP that ran a real service desk for several years usually has a deep, well-structured operating record.

AI developers are shifting from models that answer questions to agents that carry out tasks, and IT operations is a natural place to train and test them: a single ticket records the problem, the diagnosis, the tools used and the result. The page on referral opportunities for managed service providers shows how the same records look at a healthy, operating MSP.

Which closing MSPs are worth assessing

Size and history decide most cases.

• Headcount: 50+ full-time employees at peak (contractors excluded). Plenty of MSPs never reach that size, so check it first; a firm that shrank before closing can still count its peak.
• History: several years of ticket and project records, ideally including the old PSA from before a platform migration.
• Status: an MSP that is still operating, being absorbed into a roll-up, or already wound down can qualify if the records still exist.
• Sponsor: the owner, CEO, CFO or another authorized representative; in a bankruptcy or assignment, the trustee or assignee who now controls the assets.
• Separable scope: MSP-owned material that can be split cleanly from client data.

Co-managed IT providers, security-focused MSPs and cloud-partner firms with large service desks follow the same pattern. Vertical MSPs serving medical practices need extra care, covered below.

Rights and confidentiality pitfalls specific to MSPs

The MSA decides the grey zone. Before anyone discusses licensing, someone should read each client agreement's confidentiality and termination clauses. Many require the provider to return or destroy all client information when the relationship ends; where that wording reaches ticket notes, those tickets are out of scope.

Other traps come up repeatedly:

• Secrets in tickets and documentation. Passwords, MFA recovery codes, VPN keys and firewall rules turn up in notes and documentation entries. They never leave, and redaction has to find them.
• Regulated clients. The FTC's Safeguards Rule treats many non-bank businesses, such as mortgage brokers, tax preparation firms and collection agencies, as financial institutions that must protect customer information under a written security program (FTC guide). Records touching those clients' customer data should be excluded. Records from healthcare clients that contain protected health information are out of scope without HIPAA authorization or de-identification.
• White-label and subcontracted work. If the MSP ran a help desk for another provider's clients, those records may belong to that provider.
• Acquisition. If a roll-up bought the MSP, the purchase agreement decides who owns the records now, and the acquirer becomes the sponsor.
• Insolvency. Once a trustee, receiver or assignee controls the estate, only they can approve a license; the guide to overlooked intangible assets in chapter 7 explains how trustees approach records.

This is general information, not legal, tax or financial advice. Have your own counsel review the client contracts before relying on any of it.

What never leaves a closing MSP

Treat these as hard lines in any licensing discussion:

• Data stored in client tenants, servers, backups or mailboxes
• Credentials, keys, recovery codes and security configurations
• Client network diagrams, IP plans and vulnerability or incident reports
• Protected health information and customer financial information
• Ticket content where the MSA requires return or destruction of client information
• Any record a client has asked, in writing, to be deleted

A closure sequence that keeps both options open

1. Offboard clients first: return or transfer their data under each MSA and document every handover.
2. Before cancelling MSP-owned tools, export the PSA, documentation platform, internal chat and CRM; the checklist for a HubSpot export when shutting down is a good model for any CRM.
3. Put every client contract's confidentiality and destruction terms into one table.
4. Build a system-by-system inventory of MSP-owned records with the years of history in each; the guide to discussing a business data inventory with a client shows how to run that conversation.
5. Destroy client data on schedule, with certificates, whatever happens with licensing.
6. Have the board adopt clauses that preserve MSP-owned records until they are assessed, using the board resolution language for data assets.

Who can introduce a closing MSP

The people closest to an MSP's exit are well placed: MSP-focused M&A advisers and brokers, peer-group facilitators, fractional CFOs who work with IT firms, ITAD providers decommissioning the MSP's own servers, restructuring professionals and integration leads at acquiring roll-ups. Each one makes the introduction only. The MSP's sponsor works with SourceX on the inventory, the rights review and the redaction rules, and de-identification requirements are agreed before any work begins.

A conversation starter that keeps the focus on what the MSP built:

Next step

Run the closing MSP through the company fit checker, a quick, non-binding first screen. If it looks like a fit, register as a partner and introduce the owner, or the owner can apply directly at sourcex.si/apply.