Exit Guarantee
What it is
The exit guarantee is what leaves with you if you stop using CMDash. An owner can export the whole tenant, and the export carries your signed proof receipts and their transparency-log proofs, so evidence you published can still be checked after you leave.
Status: a description of what the code does today, not a contract. The public page
(/exit-guarantee) says the same. No data-escrow terms have been drafted, so no escrow of any
kind is offered.
What the export contains
- Every tenant-scoped table, unless it is explicitly excluded with a written reason. The
exclusions are listed in the archive itself (
excludedModels), so you can see what was left out and why. - Proof receipts as exact bytes. Each receipt's signed payload and signature are exported byte for byte, so its signature still verifies outside CMDash. The public half of your signing keys is exported with them.
- Transparency-log proofs. For each receipt the log can prove, the archive carries its inclusion proof against a signed checkpoint, taken at export time. A receipt no checkpoint covers yet is listed as not logged, and one the log could not prove is listed as unavailable with the reason. Neither is ever shown as proven.
- Never your private signing key. Exporting it would let whoever holds the archive mint receipts that verify under your published key, so it stays out and the archive says why.
The archive format version is 2.4; the format reference is
docs/developers/data-export-format.md. From 2.4 the JSON archive of an export taken on the hosted
service ends with a seal: proof that this service produced it for your organization.
Re-import
Self-hosted or licensed deployments (on-prem or customer-AWS): an owner can restore any export archive into a fresh, empty organization from Organization restore.
The hosted CMDash service restores only its own sealed exports, and only into the
organization they came from or into a new organization created after the export, by an owner of
the exported organization: a current owner while it is active; after it is closed, an owner at the
time of the export (the same account, or the same e-mail address proven with a one-time code). One export restores into
one organization. An archive without a seal, from another deployment, or changed after the export is
refused; arbitrary archives still answer DATA_IMPORT_SELF_HOSTED_ONLY. See
Restore a hosted export.
In every case an import into an organization that already holds data is refused, and an archive's memberships, credentials and billing records are not imported: users are matched against the target organization's own members.
When to use it
Before you commit to CMDash, to know what you can take; and when you leave, to carry your receipts with proof of their publication.
Before you start
- Role: requesting an export is Owner only; admins can view and download an existing one.
- Tier: exporting needs no tier.
How to
- Follow Data Export, Retention, and Billing to request and download the JSON archive.
- Keep each receipt file (inside
models.proof_receipts) and its entry inproofLog.entries. - To check a receipt after you leave, use the verifier with your published keys and the log section the archive carries.
Common questions
Does my signed history stay verifiable if CMDash is gone? A receipt is a signed document and its inclusion proof is carried in the archive. Verifying it still needs your public keys and the checkpoint the proof names, which the archive carries too.
Is there data escrow? No.