How to take a system away from us.

THE ACT ITSELF

Notice, and what it costs.

Either side may end the contract by giving one month's written notice. No reason is required and there is no exit fee. Either side may end it immediately if the other commits a material breach and does not fix it within 14 days of being told.

Handover is work and is charged as work, at the ordinary hourly rate on the price list. The act of leaving is charged nothing, and there is no arrangement here that costs more to end than to keep.

The handover timetable is agreed in writing when notice is given. Clause 13 of the terms governs the handover.

WHAT YOU GET

The machine, not an export.

A deployment is a database, a file store and a configuration. All three are handed over as they stand, in their working formats, rather than converted into a farewell archive that only we know how to make.

The identity

The server name is your domain. The addresses your people hold do not change hands, whoever operates the machine next.

The data

Database and file store as they stand, with nothing withheld and nothing summarised.

The configuration

The repository that builds and maintains the deployment, versioned and readable, with every setting that differs from the default and the reason beside it.

The backups

The archives as they stand, with the restore procedure written down. Where a restore has been performed and timed, the recovery point and recovery time go with it.

The credentials

Rotated at handover, so ours stop working. Keys removed and sessions ended on request, and the removal visible in your own logs.

The documents

Runbooks per component, written for whoever is on duty at two in the morning, and a named owner for every component.

Our own configuration management, tooling and documentation remain ours, and you hold a licence to use and modify them for your own deployment for as long as you want, including after the contract has ended. That is clause 11 of the terms, and it is the clause that makes the repository worth having.

THE FORMAT

Somebody else defines it, which is the point.

We do not own a format on your deployment. The engines are open-source projects with their own users, their own documentation and their own other operators, so what a dump means is defined in public and stays readable whether or not we are still here to explain it.

That is also the honest answer to lock-in. The protocol is an open standard rather than ours, another operator can pick the deployment up, and several exist. A system whose format is a private question is a system whose exit price is unknown until somebody tries.

The reverse is not ours to promise. What another supplier will release to you when you leave them is their decision, and we will not pretend to guarantee the quality of an export we do not control.

WHAT WE DESTROY

And when.

Personal data we hold as processor is deleted within 30 days of termination, including from backups as they rotate out. If you want it sooner, say so and we will do it. We keep data beyond that only where the law requires, and we tell you when that happens.

Confidentiality does not end with the contract. What we learned about your organisation stays confidential afterwards, and we do not name you as a customer at any point without written permission.

Deployment data, after termination

30 days

Backups, after deletion

35 days

Records the law makes us keep

seven years

Section 9 of the processing terms is the binding version of this, and it applies to every customer without anyone having to ask for it.

WHAT WE DO NOT HOLD

And therefore cannot hand over.

Maintaining a server means being able to reach it, and we say so plainly on the service pages rather than claiming an access we do not have. These are the things that are genuinely outside our reach.

• The content of end-to-end encrypted rooms. The keys live on the devices, not on the server, so nobody at this end can produce it and an offer to do so would be the warning sign
• Backups are encrypted with a key you keep. While we administer the machine we have access to the data itself. After our access is revoked we cannot read the backups. We can hand you the archives
• Anything on a machine we were never given access to, and any deployment after handover, where access has already been withdrawn
• Data held by a supplier you contract with directly. Their exit is their contract, not ours

A deployment on hardware you hold is a different case rather than an exception to that. There is no sub-processor there at all: the machine is yours, we act on it while we maintain it, and leaving is us removing our access. That is section 4 of the processing terms.

WHEN THE REASON IS US

Ending it from the other side.

The same one month, the same absence of a reason and the same absence of a fee apply when we are the ones stopping. Three other cases are written into the contract rather than left to goodwill.

• If we change the terms in a way that affects you materially, you are told at least 30 days before it applies and may end the contract before it takes effect
• If we add or replace a sub-processor, you get 30 days notice, and you may end the affected service without penalty if you object on reasonable data-protection grounds
• If something genuinely outside either side's control lasts more than 30 days, either side may end the contract without penalty
• If the business is transferred to a successor, the contract may go with it, and we would tell you before that happened

Configuration, operating documents and credentials are handed over during the work. A deployment on your own hardware remains yours and can be maintained by another operator.

WHAT THIS IS NOT

The limits of the page.

• It is not a continuity contract. It describes ordinary contractual and technical steps, not an insurance policy against us
• Support is provided in working hours. Clause 7 governs availability.
• It is not a disaster recovery plan for your organisation. That is separate work with its own scope, quoted in writing before it starts

If a term of this matters enough to be relied on, it belongs in the agreement rather than on a web page. The terms of service and the processing agreement are published in full, before anyone is asked to sign anything.