Leaving, and taking your data with you

Leaving should be as legible as arriving, and a vendor that is vague about the exit is telling you something. This article sets out what cancelling does, what you can actually take with you, what deletion removes, and what we keep afterwards. Parts of it describe gaps rather than features, and those parts are marked as gaps rather than dressed up as process.

Cancelling

Cancellation sets your subscription to end at the end of the current billing period. Nothing stops at the moment you press it. The confirmation reads:

{"status":"cancel_at_period_end"}

Between that moment and the period end, the service runs normally — you keep your modules, your searches and your alerts. Use the time. Cancelling is an administrator action, and the request additionally checks that the specific subscription being cancelled belongs to your organisation, not merely that you are entitled to act for the organisation; proving the second says nothing about which subscription identifier was passed.

Your invoices remain available through the billing screens and through the hosted customer portal, and each carries a link to the hosted invoice and to a PDF. Take copies of those too; they are the cheapest thing on this list to collect and the most annoying to chase later.

What the export actually contains

There is an organisation-wide export. It produces a single JSON file, delivered as a download named gdpr-export-<your organisation id>.json. It contains four collections and no more:

The honest framing is that this export was built to answer a data protection question about the personal data we hold on identifiable people, and it does that. It was not built as a migration tool.

What is genuinely worth taking, and how

Given the above, the artefacts that carry real value out of the platform are the generated ones rather than the raw ones.

1. 1

   Generate evidence bundles covering the periods you must be able to account for

   A bundle is a produced document with an integrity hash, available as JSON and as an HTML document you can print. Once stamped, it can later be shown not to have been altered — which is exactly the property that makes a filed copy worth anything. The default window inside a bundle is 30 days, so set it deliberately if you are covering a longer period. See The evidence bundle.

2. 2

   Export your posture report and its change record

   The report names your real administrators, applications and devices, and the change set records what was proposed, what was accepted and what was undone. It is the most legible summary of your security position that exists, and it is useful to whoever picks this up next.

3. 3

   Take the organisation export

   The four collections above. Small, quick, and the right answer to a data protection question later.

4. 4

   Save your invoices

   From the billing screens or the hosted portal, before the subscription ends.

5. 5

   Ask us for anything you cannot reach

   If you need something that is not in the list above, raise it before your period ends rather than after. We would rather do the work than have you find out that a route did not exist.

What deletion actually removes

There is an organisation-wide erasure operation. It runs in a single transaction with a sixty-second limit, working through the tables in a fixed order and finishing with the organisation record itself. It answers with no content, which is the correct answer: erasure is complete or it is nothing, and there is no partial result worth reporting.

The cascade covers your AI audit trail, action steps and plans, AI messages and sessions, users provisioned from your identity provider and their groups, webhook deliveries and endpoints, connector instances, licence events and licences — and then the organisation.

Two honesty points about it. A failure on one table is tolerated and skipped rather than aborting the whole operation, which means a partial erasure is possible without an error being returned to you. And the cascade does not include your collected log events, your alerts or your audit log — the same categories missing from the export are missing from the deletion. If complete removal of a category matters to you, ask us specifically about that category rather than assuming this operation covered it.

Deprovisioning is the other end state and behaves differently. A deprovisioned organisation is inactive but its record remains, so that history stays attributable to a real organisation rather than to a gap — and it cannot be reactivated through the current API. Treat deprovisioning as one-way too.

What we keep afterwards, and why

Billing records

Invoices and the subscription history behind them. These are statutory records for both of us and they are not deleted on request; every business in the EU keeps its sales invoices.

The operator access ledger

Our own hash-chained record of any support access to your tenancy, which is what makes the disclosure described in Support access, and what we can see meaningful after the fact. A record of who looked at your data is not something to delete on the request of the party that might have looked.

Backups

Copies taken before a deletion age out on their own schedule. This is a limitation of backups generally rather than a policy choice, and it is worth stating rather than glossing.

Aggregate operational metrics

Figures about the running of the platform that do not identify you or your people.

How this interacts with GDPR

You are the controller of the personal data in your tenancy and we are a processor of it. That means the obligations run to you: when one of your staff or clients exercises a right, the request is yours to answer, and the platform's job is to give you the material to answer it with.

Three things must be said plainly, because getting them wrong would put you in a worse position than having no tooling at all.

• The subject request workflow does not delete anything yet. A request can be recorded and run, and the per-module handlers behind it are placeholders: running an erasure request reports success for every module and removes no data. If somebody has exercised a right to erasure, you must satisfy it by other means. This is the single most important sentence on this page.
• Nothing tracks your response deadline. There is no timer, due date or reminder anywhere in the request handling. The one-month clock in the Regulation is real and it is yours to track in your own calendar.
• The public submission form is not protected as intended. The anti-abuse check on the route where a member of the public can submit a request is not implemented; it currently relies on rate limiting alone. Bear that in mind before publishing the link widely.

The article that covers all of this properly, including the scope warning that neither the export nor the erasure operates on a single named individual, is GDPR: subject requests, export and erasure. Read it before you answer anybody, not after.

One more thing that is yours rather than ours: if you leave in the middle of an incident, the reporting duties attached to that incident stay with your management. The platform produces the evidence; the notification is a duty on you. Take the bundle.

A leaving checklist

1. Generate evidence bundles covering the periods you must be able to account for, and file them outside the platform.
2. Export your posture report and the record of changes accepted and undone.
3. Take the organisation export, and read the list above so that you know what it is missing.
4. Save your invoices from the billing screens or the customer portal.
5. Cancel, and note the period end date — the service runs until then.
6. Only once you have confirmed you hold everything, ask us for erasure or deprovisioning, and be specific about which categories you want removed.
7. If any of this does not work as described, tell us. A documentation page that does not match the software is our defect to fix, and the exit is the worst possible place to have one.