If we terminate after two years, how do we get our data out — all of it, in usable form — and what do you delete?

The full executive answer

Exit portability is designed in, not negotiated later. Continuously — not just at exit — your data is available three ways: structured CSV export from the data modules; formatted document export of the work products — Word, PowerPoint, Excel and PDF board packs, reports and registers, generated server-side by the platform; and the versioned public REST API with TypeScript and Python SDKs, so your team can pull a complete machine-readable extraction on your own schedule, authenticated with your own API keys. Nothing about getting your data out requires a support ticket to us.

The underlying store is standard Postgres with a documented schema — 192 plain-SQL migrations define it — so a contractual full-database extract of your organisation's rows is technically trivial for us to produce, and because every tenant row is tagged with your organisation ID and isolated by row-level security, your extract is cleanly separable from every other tenant's by construction.

On deletion: the platform already has a GDPR-erasure job in production code — deletion is an engineered, scheduled process, not a manual promise — and audit logs are append-only and hash-chained, so the record that deletion happened is itself tamper-evident. This is GDPR Article 20 data portability plus Article 17 erasure, implemented rather than asserted. What I would add contractually for an enterprise deal: a defined exit-assistance period and format guarantees in the MSA — standard, and we will sign them.