When a Software Vendor Shuts Down: A SaaS Exit Plan for Small Business

On 20 October 2026, BleepingComputer reported that Zeabur, a hosting platform developers use to run websites and apps, is shutting down. It had two breaches in two months. The second exposed about 3.2 million stored records of passwords, API keys and other secrets across 321,810 accounts. Services on its shared servers pause on 1 December, and everything stops by 31 December. If your web developer built your booking page or client portal on Zeabur, you have about five weeks to move it. You may not even know it's there.

Most small business owners will read that and decide it isn't their problem. Zeabur is a tool for developers, after all. But the lesson goes well past one platform. Your business runs on software you don't own, and almost nobody has a plan for the day one of those tools disappears. This post walks through how to build a SaaS exit plan for small business owners, before you need one.

What happened at Zeabur, in plain English

Zeabur let developers connect their code and have the platform handle hosting, databases and security certificates. Lots of small apps, client sites and internal tools ran on it.

According to BleepingComputer's 20 October report, the first breach happened in late August 2026. Attackers got in through a flaw in one customer's app, moved through internal systems that weren't properly separated, and stole cloud credentials that opened the production database.

The second breach hit on 14 and 15 October. An attacker used leaked internal Zeabur credentials to get into the shared cluster, some dedicated servers and the platform database. Zeabur's own account of what went wrong is blunt:

• Credentials were stored in plain text, not encrypted.
• Not every admin credential was changed after the August breach.
• Admin portals could be reached from the open internet.
• Admin tokens never expired and hadn't been changed since January 2024.

Zeabur told customers to change every exposed password and key, sign out all active sessions, and rebuild affected servers. Then it announced it was winding down.

So customers got two jobs at once: clean up after a breach, then move everything somewhere else before the lights go off. That's a lot to ask of a business owner who didn't know the platform existed until an email turned up.

This isn't a one-off: 2026's quiet shutdowns

Zeabur is the loudest example this month, but it's far from the only one this year.

Relay.app, a workflow automation tool used by plenty of small teams, told customers on 16 July 2026 that it was closing. Free accounts had until 15 August. Paid accounts had until 14 September. Customers could export workflows as JSON files and tables as CSV files, but anything not exported by the deadline was permanently deleted. Relay's own website now says all accounts, workflows and run history are gone.

Productiv, a SaaS management platform, shut down on 6 August 2026. Write-ups from several of its competitors say customers got only days of notice. One of them, StackIQ, reported that Productiv's notice said all data and backups were destroyed. Those accounts come from rival vendors, so read them with that in mind. Still, there's an irony here. Productiv was the tool companies used to keep track of their other tools.

Meanwhile the number of tools keeps climbing. BetterCloud's 2026 State of SaaS report puts the average at 118 SaaS apps per company, up 11% on the year before. A five-person business runs far fewer than that, but each one carries more weight. When your only booking tool or your only invoicing app goes away, there's no other department to borrow from.

Why small businesses get hit hardest by a software vendor shutdown

A large company losing a vendor has an IT team, a procurement process and contracts with notice clauses. A small business usually has none of that. The same few gaps show up again and again.

Nobody owns the relationship

The account was set up by whoever needed it at the time. Maybe that was a contractor, a web developer or someone who left two years ago. The shutdown email goes to them, not to you.

The notice lands in an inbox nobody reads

Shutdown notices are usually sent to the billing or admin contact. If that's an old personal Gmail address or a shared inbox nobody checks, 60 days of notice can turn into zero.

The data lives only inside the tool

Client notes, job history, signed forms and automation logic often exist in one place only. If you've never exported it, you don't have a copy. You have access, and access can end.

Thirty days sounds like plenty, until it isn't

Exporting is the easy part. Finding a replacement, moving the data across, rebuilding automations, retraining staff and telling customers all take time. For a business with no IT person, that work competes with actually running the business.

Breach plus shutdown is a double hit

When a vendor closes after a security incident, like Zeabur, you have to treat everything stored there as exposed. That means changing passwords and keys while you migrate, not after.

Warning signs a vendor might be heading for the exit

None of these proves a tool is about to close. But if you see two or three together, it's worth checking that your exit plan is current.

• Repeated security incidents. One incident can happen to anyone. Two in quick succession, especially with the same root cause, says the company is stretched.
• Updates slow down or stop. The changelog goes quiet. Known bugs stay open for months.
• Support gets worse. Replies take days instead of hours, or the live chat quietly disappears.
• Sudden pricing or plan changes. Free tiers vanish, features get cut from cheaper plans, or you get pushed toward annual billing.
• An acquisition. Some buyouts strengthen a product. Others end with it being folded into something else or switched off.
• Staff departures in public. Founders or key engineers announcing they've moved on is often an early sign.

You don't need to watch for these constantly. A quick look once or twice a year at your most important tools is enough.

How to build a SaaS exit plan for small business

This doesn't need to be a big project. For most small teams, a first pass takes an afternoon. After that it's a short check each quarter.

Step 1: List every tool you rely on, and who holds the login

Start with a simple list. For each tool, write down:

• What it does
• Who set it up and whose email the account is under
• What it costs and when it renews
• Where the billing and admin notices go

Check your bank and card statements for the last 12 months to catch subscriptions you've forgotten. Ask your web developer or any contractor which platforms your website, forms and integrations run on. This is the step that would have caught Zeabur.

Step 2: Rank each tool by how much it would hurt to lose

Ask three questions about each tool:

1. Would we stop trading, or lose money, if it vanished tomorrow?
2. Is this the only place certain data is stored?
3. Do customers see or use it directly?

Two or three yes answers means the tool is critical. Those are the ones that need a written exit plan. Everything else just needs to be on the list.

Step 3: Learn how to export your data from SaaS tools before you need to

For each critical tool, find the export option and actually use it once. Note:

• What formats it offers (CSV, JSON, PDF)
• What comes out and what doesn't
• How long it takes

You'll often find gaps. Attachments may not export. Automations and settings may not come with the data. History may be limited to the last 90 days. Better to learn that now than with three weeks left on the clock.

Then save a copy somewhere you control, like your business cloud storage. Repeat it every quarter for critical tools.

Step 4: Keep every account in the business's name

Every critical tool should sit under a business email address, with at least two people who can log in as admin. If a contractor or developer created it, ask them to transfer ownership or add you as an owner. Your domain name deserves the same check. This one change fixes the most common reason shutdown notices go missing.

Step 5: Make sure vendor emails reach someone who reads them

Set up a shared address such as accounts@ or it@ and use it as the billing and admin contact for every subscription. Make sure it forwards to at least one person who actually checks it. Shutdown notices, breach alerts and price change emails all arrive here.

Step 6: Write down a plan B for each critical tool

You don't need to evaluate alternatives in depth. One line per tool is enough: "If our booking tool closes, the likely replacement is X, and the data we'd need to move is Y." Having that written down turns a stressful scramble into a to-do list.

Step 7: Know your first 48 hours when a notice arrives

When a shutdown email lands, do these in order:

1. Export everything straight away. Don't wait for the deadline. Shutdown timelines can shrink, as Productiv's apparently did.
2. Change any passwords or keys stored in that tool. If the vendor had a security incident, assume anything in it is exposed, the same way you would treat a password found in a leak. Change those credentials wherever else they're used.
3. Check billing. Turn off auto-renewal and ask about refunds for any prepaid period.
4. Choose a replacement and set a move date well before the vendor's deadline.
5. Tell your team and, if needed, your customers. A short heads-up beats a broken link.

Small business vendor risk is really a visibility problem

Look at the Zeabur, Relay and Productiv stories side by side and the pattern is clear. The shutdown itself isn't usually what causes the damage. The damage comes from not knowing what you rely on, where your data sits, and whose inbox the warning went to.

Most small business owners who try to track this start a spreadsheet, fill it in once, and never open it again. The renewal dates drift, the contractor's email stays on the account, and the list stops matching reality.

That's the gap Vera was built to close. Vera keeps your software licences in one dashboard, with the owner, cost and renewal date for each one, so you can see at a glance which tools your business depends on. Its breach monitoring checks your team's email addresses against Have I Been Pwned, so a vendor incident that exposes your accounts doesn't go unnoticed. And you can add "test the export for our booking tool" as a task with a due date on the IT task board, so the quarterly check actually happens.

It won't stop a vendor from closing. Nothing will. But it means that when the email arrives, you already know what's affected, who owns it, and what to do next.

The bottom line

Software vendors close. Some give you 60 days, some give you four. Some, like Zeabur, close right after a breach, leaving you to clean up and move at the same time. You can't control any of that.

What you can control is how ready you are. A SaaS exit plan for small business comes down to a handful of habits: know every tool you rely on, keep accounts in the business's name, make sure vendor emails reach a real person, test your exports, and write down a plan B for the tools that matter most. An afternoon now saves you a frantic month later.

If you'd like a simpler way to keep that list current, Vera puts your whole IT setup in one place.