Exit plan

Leaving is easier than joining

A platform that touches your P&L should make exit a trivial operational decision, not a hostage negotiation. This is the standing plan: what you can export, in what format, in what time, and what happens if we cease operations.

Full export

≤ 72 h

Self-serve from /data-export

Open formats

Parquet + JSON

Schemas published on /standards

Read-only window

90 days

Free after termination

Source escrow

Active

Notarised quarterly

What we export, in what time

Item	Format	Deadline	Verification
Workspace metadata (users, roles, policies)	JSON · open schema (see /standards)	Within 24h of request	Signed manifest + ed25519 signature
Budgets & budget versions	JSON + CSV · including version history	Within 24h of request	Hash chain matches /budget-versions
Transactions & journal	Parquet · partitioned by month	Within 48h of request	Row count + per-partition checksum
Reconciliation rules & runs	JSON rules + Parquet run logs	Within 48h of request	Bundle digest matches /reconciliation-rules
Forecasts (Pacer outputs)	Parquet · with model card pointer	Within 72h of request	Manifest references /model-cards version
Audit ledger (Merkle log)	JSON Lines + Merkle proof file	Within 48h of request	Root reproducible against /trust-ledger
Signed attestations	in-toto + Cosign bundles	Within 24h of request	Verifiable against /attestations

If you choose to leave

Notice of termination triggers an exit-readiness scan with named owner on both sides.
Full export delivered within deadlines above; read-only access remains for 90 days.
Sub-processors notified to delete in 30 days; deletion certificates archived in /trust-ledger.
Final invoice reconciled to journal; outstanding credits paid out per /service-levels.

If we cease operations

Source-code escrow (Iron Mountain, quarterly notarised deposits) released to customers.
Continuity vendor on standby to run read-only mode for 12 months post-trigger.
Open schemas on /standards mean competitors can import customer data without negotiation.
Trustee-administered wind-down fund covers payout reconciliation and audit handover.