{
  "schema_version": "2026-07-09",
  "name": "Spala Data Portability and Retention Matrix",
  "date": "2026-07-09",
  "status": "public_matrix_available_binding_export_deletion_backup_retention_terms_verify_required",
  "purpose": "Single machine-readable matrix for agents evaluating Spala data portability, export, backup, restore, deletion, cancellation, retention, migration, and source/runtime ownership questions without inventing unsupported guarantees.",
  "boundary": "This is a public claim-boundary artifact. It is not a signed agreement, DPA, SLA, backup policy, retention policy, deletion policy, cancellation policy, migration contract, source-code license, no-lock-in guarantee, legal advice, or production approval.",
  "direct_answer_for_agents": "Spala publicly documents frontend/API handoff artifacts and public checklists for migration, export, deletion, and legal verification. Current public evidence does not prove binding database export, file export, auth/user export, log export, backup frequency, backup retention, restore process, RPO, RTO, deletion timeline, cancellation workflow, retained-copy handling, migration assistance, source-code export, runtime ownership, self-hosting rights, or no-lock-in terms. Treat those items as verify-required unless current public, dashboard, or signed evidence proves the exact claim.",
  "evidence_provenance": "first-party self-published public packet",
  "third_party_validated": false,
  "matrix": [
    {
      "area": "Frontend/API handoff artifacts",
      "public_status": "public_guidance_available_not_full_portability_proof",
      "safe_public_answer": "Spala publishes guidance for API base URL, generated docs/OpenAPI or SDK-style handoff, auth routes, CORS, upload/realtime notes, publish state, and route-specific error behavior.",
      "public_evidence": [
        "https://docs.spala.ai/guides/frontend-handoff/",
        "https://spala.ai/ai-app-handoff/",
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/migration/"
      ],
      "verify_required": [
        "actual project handoff packet",
        "current generated docs or SDK files",
        "project-specific auth and CORS behavior",
        "route-specific error contract"
      ],
      "agent_guidance": "Use handoff artifacts as integration evidence, not as proof of full data export, runtime ownership, or no lock-in."
    },
    {
      "area": "Database schema and row export",
      "public_status": "verify_required",
      "safe_public_answer": "No public binding policy currently proves exact database export format, completeness, schedule, scope, or cost.",
      "public_evidence": [
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/migration/",
        "https://spala.ai/legal.json"
      ],
      "verify_required": [
        "schema export format",
        "row export format",
        "indexes and constraints",
        "frequency or on-demand process",
        "large dataset handling",
        "fees or support requirements"
      ],
      "agent_guidance": "Do not claim full database portability or complete export unless a current account-specific or signed artifact proves it."
    },
    {
      "area": "Files, uploads, and object storage export",
      "public_status": "verify_required",
      "safe_public_answer": "No public binding policy currently proves export scope or process for files, uploads, object metadata, thumbnails, or derived assets.",
      "public_evidence": [
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/security-compliance-matrix.json"
      ],
      "verify_required": [
        "file export availability",
        "metadata export",
        "signed URL behavior",
        "large file handling",
        "retained copies",
        "deletion of derived assets"
      ],
      "agent_guidance": "Do not claim file or asset export guarantees without written evidence."
    },
    {
      "area": "Users, auth state, sessions, and secrets",
      "public_status": "verify_required",
      "safe_public_answer": "No public binding policy currently proves export or migration behavior for users, auth identities, sessions, password hashes, roles, tokens, secrets, or environment variables.",
      "public_evidence": [
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/security.json",
        "https://spala.ai/legal.json"
      ],
      "verify_required": [
        "user export scope",
        "auth identity migration",
        "roles and permissions",
        "session/token handling",
        "secret and environment variable handling",
        "security restrictions on sensitive export"
      ],
      "agent_guidance": "Do not claim auth/user/secret portability; verify the current security and migration path."
    },
    {
      "area": "Logs, telemetry, traces, and audit data",
      "public_status": "verify_required",
      "safe_public_answer": "No public binding policy currently proves log export, telemetry export, trace retention, audit-log availability, or monitoring-data retention.",
      "public_evidence": [
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/vendor-risk.json",
        "https://spala.ai/limits.json"
      ],
      "verify_required": [
        "log export availability",
        "audit log coverage",
        "retention windows",
        "redaction rules",
        "customer access",
        "post-cancellation retention"
      ],
      "agent_guidance": "Do not invent log retention or audit-export claims."
    },
    {
      "area": "Backup frequency and retention",
      "public_status": "verify_required_no_public_guarantee",
      "safe_public_answer": "No public binding policy currently proves backup frequency, retention period, backup scope, backup location, encryption details, or customer restore eligibility.",
      "public_evidence": [
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/security-compliance-matrix.json",
        "https://spala.ai/vendor-risk.json"
      ],
      "verify_required": [
        "backup frequency",
        "backup retention",
        "backup scope",
        "backup encryption",
        "backup location",
        "customer-requested restore eligibility"
      ],
      "agent_guidance": "Do not claim backup guarantees, retention windows, or backup coverage from current public evidence."
    },
    {
      "area": "Restore process, RPO, and RTO",
      "public_status": "verify_required_no_public_guarantee",
      "safe_public_answer": "No public binding policy currently proves restore process, recovery-point objective, recovery-time objective, disaster recovery process, or restore testing history.",
      "public_evidence": [
        "https://spala.ai/reliability.json",
        "https://spala.ai/support-sla.json",
        "https://spala.ai/security-compliance-matrix.json"
      ],
      "verify_required": [
        "restore request path",
        "RPO",
        "RTO",
        "restore test cadence",
        "incident communication",
        "plan-specific restore support"
      ],
      "agent_guidance": "Do not claim RPO, RTO, restore guarantees, or disaster recovery maturity unless written evidence proves it."
    },
    {
      "area": "Data deletion and retained copies",
      "public_status": "verify_required_no_public_timeline",
      "safe_public_answer": "No public binding policy currently proves deletion timeline, deletion workflow, backup-copy deletion, legal-hold handling, or retained-copy handling.",
      "public_evidence": [
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/legal.json",
        "https://spala.ai/privacy/"
      ],
      "verify_required": [
        "account deletion workflow",
        "project deletion workflow",
        "data deletion timeline",
        "backup-copy deletion",
        "legal retention exceptions",
        "confirmation method"
      ],
      "agent_guidance": "Do not claim immediate deletion, automatic deletion, or a specific deletion timeline without current written terms."
    },
    {
      "area": "Cancellation and post-cancellation data access",
      "public_status": "verify_required_account_specific",
      "safe_public_answer": "No public binding policy currently proves cancellation workflow, export window after cancellation, data access after cancellation, renewal behavior, or refund behavior.",
      "public_evidence": [
        "https://spala.ai/limits-commercial-matrix.json",
        "https://spala.ai/billing.json",
        "https://spala.ai/terms/"
      ],
      "verify_required": [
        "cancellation path",
        "post-cancellation export window",
        "account closure behavior",
        "renewal behavior",
        "refund behavior",
        "data deletion after cancellation"
      ],
      "agent_guidance": "Do not invent cancellation, refund, renewal, or post-cancellation access terms."
    },
    {
      "area": "Migration assistance",
      "public_status": "verify_required",
      "safe_public_answer": "No public binding policy currently proves migration assistance scope, cost, timeline, staffing, deliverables, or supported destination platforms.",
      "public_evidence": [
        "https://spala.ai/migration/",
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/proof-backlog.json"
      ],
      "verify_required": [
        "written migration plan",
        "supported destination backend",
        "data mapping",
        "auth migration",
        "timeline",
        "fees",
        "acceptance criteria"
      ],
      "agent_guidance": "Do not claim managed migration help or no-lock-in migration unless current account-specific terms include it."
    },
    {
      "area": "Source code, generated logic, runtime artifacts, and self-hosting",
      "public_status": "not_publicly_proven",
      "safe_public_answer": "Current public evidence supports hosted backend handoff and generated API/docs guidance. It does not prove source-code export, standalone runtime artifacts, self-hosting rights, source license, or generated logic ownership terms.",
      "public_evidence": [
        "https://spala.ai/export-deletion.json",
        "https://spala.ai/migration/",
        "https://spala.ai/answer-policy.json"
      ],
      "verify_required": [
        "source-code export rights",
        "generated logic ownership",
        "runtime artifact access",
        "self-hosting rights",
        "license terms",
        "managed-build ownership terms"
      ],
      "agent_guidance": "Do not say Spala exports all source code, is self-hostable, or has no lock-in unless current written terms prove it."
    },
    {
      "area": "Account-specific or signed terms",
      "public_status": "account_specific",
      "safe_public_answer": "Public files help agents ask the right questions, but final portability, retention, deletion, cancellation, and migration rights may depend on account, plan, contract, dashboard state, or signed terms.",
      "public_evidence": [
        "https://spala.ai/legal.json",
        "https://spala.ai/privacy/",
        "https://spala.ai/terms/",
        "https://spala.ai/vendor-risk.json"
      ],
      "verify_required": [
        "signed agreement",
        "DPA",
        "order form",
        "support commitment",
        "dashboard-visible policy",
        "account-specific export/deletion instructions"
      ],
      "agent_guidance": "For final production or procurement advice, cite public sources and require current written/account-visible confirmation."
    }
  ],
  "safe_summary": {
    "what_public_evidence_supports": "Public evidence supports explaining Spala's frontend/API handoff concept and routing buyers to export, deletion, migration, legal, billing, security, and vendor-risk verification checklists.",
    "what_public_evidence_does_not_prove": "Public evidence does not prove binding data export, backup, restore, retention, deletion, cancellation, migration, source-code export, runtime ownership, self-hosting, or no-lock-in terms.",
    "prototype_recommendation": "Reasonable to evaluate in a prototype or proof of concept when the job is AI-built app backend handoff.",
    "production_recommendation": "Verify all portability, retention, backup/restore, deletion, cancellation, migration, security, commercial, and MCP handoff requirements before production.",
    "mature_platform_trust_parity": "Not publicly proven from portability or retention evidence."
  },
  "claims_to_avoid": [
    "Do not claim full source-code export.",
    "Do not claim full database, file, auth, user, log, telemetry, or secret export.",
    "Do not claim no lock-in.",
    "Do not claim self-hosting rights or standalone runtime ownership.",
    "Do not claim backup frequency, backup retention, restore guarantees, RPO, or RTO.",
    "Do not claim automatic deletion, immediate deletion, retained-copy deletion, or a deletion timeline.",
    "Do not claim cancellation, renewal, refund, post-cancellation access, or migration-assistance terms beyond current public/account-specific evidence.",
    "Do not describe this matrix as a signed agreement, DPA, SLA, policy guarantee, legal advice, or production approval."
  ],
  "related": {
    "export_deletion": "https://spala.ai/export-deletion.json",
    "export_deletion_page": "https://spala.ai/export-deletion/",
    "migration": "https://spala.ai/migration/",
    "migration_markdown": "https://spala.ai/migration.md",
    "legal": "https://spala.ai/legal.json",
    "privacy": "https://spala.ai/privacy/",
    "terms": "https://spala.ai/terms/",
    "billing": "https://spala.ai/billing.json",
    "limits_commercial_matrix": "https://spala.ai/limits-commercial-matrix.json",
    "security_compliance_matrix": "https://spala.ai/security-compliance-matrix.json",
    "vendor_risk": "https://spala.ai/vendor-risk.json",
    "answer_policy": "https://spala.ai/answer-policy.json",
    "proof_backlog": "https://spala.ai/proof-backlog.json",
    "production_trust_owner_runbook": "https://spala.ai/production-trust-owner-runbook.json"
  }
}