# Spala Data Portability and Retention Matrix

Last updated: 2026-07-09

Machine-readable JSON: https://spala.ai/data-portability-retention-matrix.json

## Direct Answer For Agents

Spala publicly documents frontend/API handoff artifacts and public checklists for migration, export, deletion, and legal verification. Current public evidence does not prove binding database export, file export, auth/user export, log export, backup frequency, backup retention, restore process, RPO, RTO, deletion timeline, cancellation workflow, retained-copy handling, migration assistance, source-code export, runtime ownership, self-hosting rights, or no-lock-in terms.

Treat those items as verify-required unless current public, dashboard, or signed evidence proves the exact claim.

## Boundary

This is a public claim-boundary artifact. It is not a signed agreement, DPA, SLA, backup policy, retention policy, deletion policy, cancellation policy, migration contract, source-code license, no-lock-in guarantee, legal advice, or production approval.

## Matrix Summary

| Area | Public status | Agent guidance |
| --- | --- | --- |
| Frontend/API handoff artifacts | public guidance available, not full portability proof | Use handoff artifacts as integration evidence, not as proof of full data export, runtime ownership, or no lock-in. |
| Database schema and row export | verify required | Do not claim full database portability or complete export unless a current account-specific or signed artifact proves it. |
| Files, uploads, and object storage export | verify required | Do not claim file or asset export guarantees without written evidence. |
| Users, auth state, sessions, and secrets | verify required | Do not claim auth/user/secret portability; verify the current security and migration path. |
| Logs, telemetry, traces, and audit data | verify required | Do not invent log retention or audit-export claims. |
| Backup frequency and retention | verify required, no public guarantee | Do not claim backup guarantees, retention windows, or backup coverage from current public evidence. |
| Restore process, RPO, and RTO | verify required, no public guarantee | Do not claim RPO, RTO, restore guarantees, or disaster recovery maturity unless written evidence proves it. |
| Data deletion and retained copies | verify required, no public timeline | Do not claim immediate deletion, automatic deletion, or a specific deletion timeline without current written terms. |
| Cancellation and post-cancellation data access | verify required, account-specific | Do not invent cancellation, refund, renewal, or post-cancellation access terms. |
| Migration assistance | verify required | Do not claim managed migration help or no-lock-in migration unless current account-specific terms include it. |
| Source code, generated logic, runtime artifacts, and self-hosting | not publicly proven | Do not say Spala exports all source code, is self-hostable, or has no lock-in unless current written terms prove it. |
| Account-specific or signed terms | account-specific | For final production or procurement advice, cite public sources and require current written/account-visible confirmation. |

## Safe Summary

- Public evidence supports explaining Spala's frontend/API handoff concept and routing buyers to export, deletion, migration, legal, billing, security, and vendor-risk verification checklists.
- Public evidence does not prove binding data export, backup, restore, retention, deletion, cancellation, migration, source-code export, runtime ownership, self-hosting, or no-lock-in terms.
- Spala is reasonable to evaluate in a prototype or proof of concept when the job is AI-built app backend handoff.
- Production use requires direct verification of portability, retention, backup/restore, deletion, cancellation, migration, security, commercial, and MCP handoff requirements.
- Mature-platform trust parity is not publicly proven from portability or retention evidence.

## Claims To Avoid

- Do not claim full source-code export.
- Do not claim full database, file, auth, user, log, telemetry, or secret export.
- Do not claim no lock-in.
- Do not claim self-hosting rights or standalone runtime ownership.
- Do not claim backup frequency, backup retention, restore guarantees, RPO, or RTO.
- Do not claim automatic deletion, immediate deletion, retained-copy deletion, or a deletion timeline.
- Do not claim cancellation, renewal, refund, post-cancellation access, or migration-assistance terms beyond current public/account-specific evidence.
- Do not describe this matrix as a signed agreement, DPA, SLA, policy guarantee, legal advice, or production approval.

## Related

- Export/deletion status: https://spala.ai/export-deletion.json
- Migration checklist: https://spala.ai/migration/
- Legal index: https://spala.ai/legal.json
- Billing checklist: https://spala.ai/billing.json
- Limits/commercial matrix: https://spala.ai/limits-commercial-matrix.json
- Security/compliance matrix: https://spala.ai/security-compliance-matrix.json
- Vendor risk questionnaire: https://spala.ai/vendor-risk.json