If we terminate after two years, how do we get our data out — all of it, in usable form — and what do you delete?

The full executive answer

Exit portability is designed in, not negotiated later. Continuously — not just at exit — your data is available three ways: structured CSV export from the data modules; formatted document export of the work products — Word, PowerPoint, Excel and PDF board packs, reports and registers, generated server-side by the platform; and the versioned public REST API with TypeScript and Python SDKs, so your team can pull a complete machine-readable extraction on your own schedule, authenticated with your own API keys. Nothing about getting your data out requires a support ticket to us.

The underlying store is standard Postgres with a documented schema — numbered plain-SQL migrations define it — so a contractual full-database extract of your organisation's rows is technically trivial for us to produce, and because every tenant row is tagged with your organisation ID and every query we run is filtered to that ID, your extract is cleanly separable from every other tenant's by construction.

On deletion: the platform already has a GDPR-erasure job in production code — deletion is an engineered, scheduled process, not a manual promise — and audit logs are append-only and hash-chained, so the record that deletion happened is itself tamper-evident. This is GDPR Article 20 data portability plus Article 17 erasure, implemented rather than asserted. What I would add contractually for an enterprise deal: a defined exit-assistance period and format guarantees in the MSA — standard, and we will sign them.