Three years on managed cloud. Decision to leave: object storage export shows 40 TB, outbound transfer billed €0.09/GB, proprietary APIs on database. Exit quote: €18,000 and six weeks — not in budget. Contract said "reversibility guaranteed".
Reversibility — ability to leave a host or cloud without losing data or facing ransom — is tested before dependency, not on termination day. GDPR, public procurement, and common sense require readable export, delays, and deletion. Vague terms are not enough.
Dimensions of an exit test
Data: SQL dump, bucket sync, VM snapshots. Configuration: infrastructure as code, DNS, certificates, firewall rules. Metadata: access rights, labels, lifecycle rules. Dependencies: CDN, email, integrated registry.
| Lock-in signal | Test | Alert threshold |
|---|---|---|
| Billed outbound transfer | Simulate 1 TB export | > annual budget |
| Closed format | Restore elsewhere | Import failure |
| Support delay | Export ticket | > 5 business days |
"We can always leave" without measured exercise is belief — not a plan.
Reduce lock-in from design
Prefer open formats (PostgreSQL dump, S3-compatible, Terraform). Backup outside main account. Keep DNS at independent registrar. Document architecture. Read Egress fees before large volumes.
The peak: prison at exit
Decide and move forward without blind spots
Plan a dry-run export this quarter on a representative dataset. Negotiate outbound transfer cap at signing if volumes justify. Document duration, cost, and formats in an internal report. See directory, compare tool, and Data deletion to align exit and erasure.
Frequently asked questions
Is reversibility mandatory under GDPR?
Subprocessor export and deletion required — specify formats and delays in contract.
What to test before committing?
Full representative set with timing and measured outbound transfer cost.
Do proprietary APIs matter?
Yes — standard export may be incomplete for managed services.
What to negotiate at signing?
Delay, open format, transfer cap, assistance, deletion certificate.
Reversibility is proven by exporting a sample — not reading a clause.