Before you wipe the servers: a records checklist for closing companies

Why this checklist exists

When a company closes, hardware is among the first things sold, returned or recycled. Servers, NAS devices, backup appliances and laptops go to an IT asset disposition (ITAD) vendor or a liquidator, and once a drive is wiped or shredded, every record on it is gone. Before wiping company servers, image or export what is worth keeping, get written sign-off, and screen the archive for licensing value.

Mid-size companies often keep more on premises than people expect: file servers with a decade of project folders, a legacy ERP database, an old on-premises mail server, backup sets from systems retired years ago. Those archives can hold the operational history that AI labs and data buyers license through SourceX. They can also hold customer and employee information the company has obligations to protect, which is why authority, retention and destruction need to be decided together.

Two legal points often apply. If the company is a non-bank financial institution under the FTC's Safeguards Rule (the FTC lists examples such as mortgage brokers, finance companies, collection agencies and tax preparation firms), its written information security program covers the customer information on these devices (FTC Safeguards Rule guide). And a business covered by the CCPA must tell California consumers at collection how long it retains their personal information (Cal. Civ. Code 1798.100 et seq.), so check what was promised before deciding what to keep. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

The checklist

1. Inventory every device

• List physical and virtual servers, NAS and SAN units, backup appliances, tape libraries, desktops, laptops, external drives and company phones, including anything in a colocation cage or offsite storage.
• For each device, note what it holds, the years covered, the last successful backup and who has admin credentials.
• Record encryption status and locate recovery keys; an image of an encrypted drive without its key is unreadable.
• Separate leased equipment, which must be returned, from owned equipment, which can be sold.
• Mark devices of departed employees whose files were never moved to a shared location.

2. Confirm authority and sign-off

• Identify who controls the assets now: the board or owner, an assignee, a trustee, a receiver or a secured lender.
• Ask counsel about litigation holds, regulatory retention periods and tax record requirements before anything is wiped.
• Check whether a lender holds a security interest in the equipment or the data on it.
• Get written approval of the wipe list from the person in control, listing devices by serial number.

3. Image or export before release

• Take full images or complete exports of file servers, databases (with schema) and on-premises mail servers.
• Keep backup catalogs and a working copy of the software needed to read proprietary backup formats.
• Record hash values and file or record counts for each image, and keep a chain-of-custody log.
• Store images in two company-controlled locations with documented access.

4. Screen for licensable archives

• Run the company fit checker: 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license and an authorized sponsor.
• Tag each archive as the company's own operational records, client-owned material, or mainly consumer personal data or PHI.
• Hold archives that could be licensable out of the destruction schedule until the review is done.

5. Release the hardware

• Use an ITAD contract that specifies the method (overwrite, degauss or shred) and serial-level certificates of destruction.
• Reconcile certificates against the inventory, serial by serial.
• File the certificates with the company's closing records.

Cloud tools need the same discipline: the companion checklist export before you cancel covers SaaS subscriptions, and the guide to company email archives when closing a business covers mailboxes in more depth.

How to use the results

Red flags that stop a licensing review

• The file shares hold work the company did for its own clients, and those clients never agreed to any reuse.
• Most of what sits on the drives is information about consumers or patients, with no consent, authorization or de-identification behind it.
• The assignee, trustee or receiver now in charge has not been told about the archive.
• An earlier AI-training license already covers the same material.
• No remaining officer or fiduciary is able to approve a license, and no one can read the backups.

Ownership questions for each system are easier to settle with the system ownership checklist. For background on what usually happens to records after closure, see what happens to company data when a business closes.

How partners fit in

Partners make the introduction and share basic fit information, such as device types, years covered and peak headcount; the full baseline is on who qualifies. They never take custody of drives or images, and they never describe confidential contents. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward becomes payable only after the buyer pays and SourceX receives its fee.

Next step

Put the inventory and sign-off steps in front of whoever controls the assets before the ITAD pickup is booked. If an archive passes the screen, register as a partner and introduce the company while the data still exists.