The sixty-second answer
You are normally given a notice period and an export window, then access ends. The window is shorter than most owners expect and arrives without regard to your schedule. Your obligations to your customers do not pause during it, so the only reliable protection is an export you already made and already opened.
Three ways a provider goes away
"Shuts down" covers three quite different events, and the one you should plan for is the least dramatic.
Insolvency. Rare, abrupt, and the worst case. Service may stop with little warning, support disappears because there is nobody left to staff it, and your contractual right to assistance is a claim against an estate rather than something you can act on.
Acquisition. Common, and superficially reassuring. The product continues, sometimes for years. But the terms change, the roadmap changes, and acquisition is the single most frequent path to the third case.
Discontinuation. By far the most likely. Nothing fails; the vendor simply decides a product is no longer worth maintaining and gives customers a wind-down period. This is a business decision made by a healthy company, which means it can happen to a vendor with every sign of stability.
Plan for the third and you are covered for all three.
What the contract does and does not do
Your agreement will usually state a retention period after termination and some form of export assistance. Both are meaningful in an orderly wind-down and close to worthless in a disorderly one, because a contract binds a company that still exists and still has staff.
This is worth being clear-eyed about, because the sales conversation rarely is. Under the Competition Act, a representation to the public that is false or misleading in a material respect is reviewable, and a performance or efficacy claim must be based on an adequate and proper test, with the proof of that test lying on the person making the representation [3]. That gives you a fair question to ask during buying: what actually happens to my data if you stop operating, and can you show me the process rather than describe it? A vendor who can walk you through a real export is telling you something a reliability claim in a deck cannot.
Contrast this with domain names, where the rules are written down and enforceable. Under ICANN's Transfer Policy, registered name holders must be able to transfer registrations between registrars, transfer processes must be clear and concise, denial is confined to enumerated instances such as evidence of fraud or non-payment, and a transfer lock must be removed or an accessible removal method provided within five calendar days [2]. Business software has no equivalent regime. Nobody is going to require your vendor to hand your records back on a defined timetable, which is precisely why the export habit has to be yours.
Your obligations do not pause
The part most owners miss is that a vendor's collapse does not suspend anything you owe your own customers.
PIPEDA's Schedule 1 requires that purposes for collection be identified before or at the time of collection (Principle 2), that collection and use rest on knowledge and consent (Principle 3), and that personal information not be used or disclosed for purposes other than those consented to (Principle 5) [1]. Principle 8 requires your policies and practices about handling personal information to be readily available to individuals, and Principle 9 provides that on request an individual shall be informed of the existence, use and disclosure of their information, be given access to it, and be able to challenge its accuracy and have it amended [1].
Read Principle 9 against a shutdown. A customer emails during your wind-down asking what you hold about them. If the answer is locked inside a system whose support desk no longer answers, you have a problem that is yours, not the vendor's. The export is what turns that from a crisis into a file search.
Clause 4.5.3 is the other half. Information no longer required should be destroyed, erased or made anonymous, and organisations shall develop guidelines and implement procedures governing that destruction [1]. Note what this means in a migration: you are obliged to think about what should not come across, not just what should. A shutdown is an unusually good moment to actually apply a retention rule, because you are handling every record anyway. Our guide to PIPEDA requirements for small businesses covers the full set.
An acquisition raises the same question from a different angle. Your customers gave you their information for your stated purpose. If the acquirer intends a different use, that is a new purpose, and Principle 5 is where it has to be tested [1].
Export before you need it
This is the whole practice, and it is short.
Export on a schedule. Monthly for customer records and financial data is enough for most businesses. Immediately before any renewal or terms change, without exception.
Open the file. An export you have never opened is a guess. Confirm it contains history, notes, dates and attachments — not just a list of names. This is the step everyone skips, and it is the step that determines whether the backup was real.
Store it somewhere the vendor does not control. An export sitting inside the same platform is not a backup of that platform.
Keep the format boring. CSV, JSON, standard document files. Anything you can open without the software that produced it. A proprietary archive restorable only by the vendor is useless in exactly the scenario you are preparing for.
Do this once as a trial condition before you buy, then on a schedule after. Our article on who owns your data in business software covers the contract side of the same question, and switching business software without downtime covers what to do with the file when the day arrives.
The first week after the notice
Export first. Everything, immediately, before you look at a single replacement. Access ends on a date you do not control; the replacement decision does not.
Then map what depended on the dying system. A booking tool feeding a calendar, a customer list feeding a mail platform, an invoicing link on a website. Each of these breaks separately and quietly, and the ones you forget are found by customers.
Check your obligations against the gap. If financial records were living there, remember that the small supplier test runs over four consecutive calendar quarters [6] — you need continuous figures across the transition, not a hole where the migration was. And if the system held your marketing consent records, extract those specifically, because Canada's Anti-Spam Legislation requires consent, express or implied, before a commercial electronic message and requires prescribed identifying and contact information within it [4]. Consent you cannot evidence is consent you do not have.
Tell customers only what affects them. Most shutdowns are invisible to the people you serve, and announcing internal turbulence you have already handled buys nothing.
Why this lands hardest on small businesses
Small businesses are 1.08 million of Canada's 1.10 million employer businesses [5]. Almost none of them have anyone whose job is vendor risk. The realistic defence is not a review process; it is one recurring calendar entry that says "export, open it, confirm." That single habit converts the worst version of this event into an annoying week.
Where we sit
We would rather you hold a current export of your MapleWorkSuite data than trust us not to need it. Export is available in formats you can open without us, and we will demonstrate it before you commit rather than describe it. We run on Canadian infrastructure operated by a Canadian company, which does not make us immortal but does mean that during any wind-down you would be dealing with people in your own time zone and under your own law.
We will not claim that choosing us removes this risk, because no vendor can. What we will say is that a supplier who makes leaving straightforward has told you something real about how they expect to keep your business. If you are auditing this across everything you run, our guide to Canadian-hosted business software covers what a good answer about location and control sounds like.