Second, understand where the code/system currently is. If it's on your server (defined as a server you own or rent), you have different options than if it's on their server.
If it's your server - unless you have a commitment to continue providing the service - you may be able to shut it off immediately.
If they have granted you access to their server for the "duration of the project", you may be able to make the argument that the project isn't over yet and do things.. but speak to an attorney.
Either way, if this is a mission critical app for them, disrupting their business can cause other difficulties for you that you don't want.
Collect the information you have - agreements, records of payments, commitments (written are best, verbal are usually worthless), and ownership - and speak to an attorney. In the US, many lawyers will speak with you for 30 minutes for free as they evaluate your case and lay out options.