Exit guarantee

The CMDash exit guarantee

Your data is yours to take. An owner or admin can export the whole tenant, and the export carries the signed proof receipts and their transparency-log proofs, so evidence you published can still be checked after you leave.

This page is not a contractual commitment. It states what the CMDash code does, each point with its source. It does not offer data escrow of any kind.

What the export contains

Every tenant-scoped table, unless explicitly excluded with a reason. The export is driven by a registry read from the database schema, so a newly added table is exported automatically; it is left out only by a written, reasoned entry that appears in the archive itself (excludedModels).
Proof receipts as exact bytes. Each receipt’s signed payload and signature are exported byte-for-byte, so its signature still verifies outside CMDash. The public half of your signing keys is exported with them.
Transparency-log proofs. For each receipt the log can prove, the archive carries its inclusion proof against a signed checkpoint. A receipt no checkpoint covers yet is listed as not logged, and one the log could not prove is listed as unavailable with the reason. Neither is ever shown as proven.
Your private signing key is never exported. Exporting it would let whoever holds the archive mint receipts that verify under your published key, so it stays out and the archive says why.

Re-import: self-hosted and licensed deployments

An export archive can be restored into a fresh, empty organization on a self-hosted or licensed CMDash deployment (on-prem or customer-AWS). An integration test drives a real export, a real import and a re-export against PostgreSQL with row-level security enforced, and checks that row counts and business content match and that references are re-pointed at the new rows. Importing into a tenant that already holds data is refused, and the archive’s memberships are not imported: users are matched against the target organization’s own members.

Proving tests, in the CMDash repository: apps/api/test/tenant-import.integration.spec.ts (export, import and re-export of a tenant), apps/api/test/data-export-bytes.spec.ts (receipt bytes survive the archive and the importer’s decode), and apps/api/test/data-export-proof-log.spec.ts (the log proofs in the archive verify against their signed root).

On the hosted service

You can export your data from the hosted service. Self-service re-import Coming soon: the import routes refuse on the multi-tenant deployment with the error DATA_IMPORT_SELF_HOSTED_ONLY, and the application tells you to contact support to migrate data.

Source: apps/api/src/data-import/data-import.controller.ts, pinned by apps/api/test/data-import-saas-refusal.spec.ts.

What this page is not

It is not an escrow offer.
It does not claim that a restored tenant can keep issuing receipts under its old signing key, because that key is never exported.
It does not promise a service level for migrations. See the Terms of Service for what is contractual.