You are 100% correct - that was the exact situation with us. If we're leaving a service, and we were told we were in control of that data, any remotely diligent

You are 100% correct - that was the exact situation with us. If we're leaving a service, and we were told we were in control of that data, any remotely diligent security process would involve exporting all data on the service in a secure manner, then removing the data from the control of the third party provider.