On-premise software vendors: you may hold less data than you think

What data does an on-premise software vendor actually hold?#

An on-premise software vendor holds the records of making and supporting its product, not its customers' operating data. When customers install the software on their own servers or private cloud, the transactions, documents and user records it processes stay with them.

Founders who expect a rich customer database are often disappointed at first. Then they find that the vendor side holds something different and often more distinctive: years of bug reports from varied customer environments, the fixes that resolved them, the release decisions behind each version and the implementation work that configured the product for each industry.

A record map for on-premise vendors#

A record map shows, system by system, what the vendor controls and what it merely stores on a customer's behalf. Use it to plan the inventory, not to decide rights; the answer for each row depends on your end-user license agreements, maintenance agreements and any custom terms with large customers.

The trap on the support file share#

The support file share is where on-premise vendors most often find customer data they forgot they had. To reproduce bugs, support engineers ask customers for database backups, exported tables or full diagnostic bundles, and those files accumulate on FTP servers, shared drives and engineers' laptops for years.

Those copies are customer data held for a specific purpose under support terms. They generally cannot be licensed, and some maintenance agreements require their deletion once the issue closes. Find them during the inventory, exclude them from any package and decide with counsel whether old copies should be deleted.

The same applies to customer data pasted into tickets: query results, sample records and screenshots of customer screens. Those need the same de-identification and contract review as any support history, and often more.

Why vendor-side records can still be valuable#

Vendor-side records are valuable because they show how domain software is built, debugged and maintained over long periods. A vendor that has shipped maintenance releases for years to customers on different database versions, operating systems and configurations holds a record of real-world failure modes that no public repository captures.

Those histories suit coding assistant and agent developers who need examples of diagnosis across messy environments. In the SourceX Enterprise Data Value Framework, they score on domain expertise, uniqueness and human-generated signal, while preparation cost rises with the age of the systems that hold them.

• 1Bug reports linked to the customer environment details that caused them.
• 2Hotfixes and patches linked to the tickets that triggered them.
• 3Upgrade and migration tickets across product versions.
• 4Implementation decisions recorded in project plans and configuration notes.
• 5Release planning discussions that explain what shipped and what was cut.

Where an older vendor's records actually sit#

An older vendor's records usually sit in more systems than anyone remembers, because tooling changed several times while the product stayed on sale. The inventory should start from the people who ran support and engineering in each era, not from the current IT asset list.

Expect gaps. A help desk retired without an export, or a version control server shut down after a migration, can leave a missing stretch of history. Record those gaps honestly in the inventory; a buyer can work with a known gap far more easily than with one discovered late.

• 1Retired version control servers, such as Subversion, Perforce or older Git hosts, and the migration notes that moved history forward.
• 2Help desks replaced over the years, plus email-based support inboxes that came before them.
• 3Implementation consultants' shared drives with project plans, configuration exports and customer sign-off documents.
• 4Build and release servers holding release notes, build logs and hotfix records.
• 5Partner and reseller portals where escalated cases were logged.

Hybrid vendors: split the archive by deployment model#

Hybrid vendors that now offer a hosted version need to split their archive by deployment model, because the rights position changes. Hosted customers' data is processed by the vendor under a different contract, often with data processing terms that limit use to providing the service.

Tag tickets, issues and repositories with the deployment model they relate to where possible. That makes it practical to apply different rules to each part of the archive instead of excluding everything to be safe.

Illustrative: a print shop software vendor finds its real archive#

Illustrative: a fictional vendor of on-premise estimating and scheduling software for commercial print shops has sold perpetual licenses with annual maintenance for many years. The founder assumes the valuable data is in customers' job databases and asks whether those can be licensed.

The inventory shows they cannot: the vendor never had them, apart from customer backups on an old support FTP server, which counsel flags for exclusion and later deletion. What the vendor does hold is a Subversion history migrated to Git, an issue tracker with linked fixes, a long support ticket history and implementation playbooks for print workflows.

The scoped package covers code, issues, code reviews and de-identified tickets, with playbooks stripped of customer names. The founder approves it knowing that no customer's job data is involved.

How SourceX approaches on-premise vendors#

SourceX starts with a fit check that collects only metadata: which systems hold engineering and support history, how far back it goes and which deployment models the records cover. Nothing is shared during that assessment.

In the Rights step of the SourceX five-step transaction, end-user license and maintenance agreements are reviewed to confirm which records are the vendor's own. The SourceX Evidence Packet then records provenance and permitted use, which matters for vendors whose records span many product versions and contract forms.