Leaving should be a decision, not a negotiation.
Your data is yours, in enough detail to hold us to: what we hold, in what shape, for how long, who can reach it, and precisely what lands in your hands if you go.
Three layers, and only one of them is ours.
| Layer | What it is | Whose it is |
|---|---|---|
| Raw archive | The exact bytes your systems sent, with the time, principal, source address and content hash. | Yours. This is the layer that answers an audit, and it never changes. |
| Normalized events | Those bytes interpreted into a documented internal shape. | Yours. Derived from the archive and re-derivable at any time. |
| Projections | The views each product reads: priced fills, claims, cases, registers. | Ours to compute, yours to keep. Delete every projection and nothing is lost, because they can all be rebuilt from the archive. |
The durable truth is the archive rather than our interpretation of it, so a change to how margin is calculated cannot corrupt your history. We re-run the projection and the record of what actually happened is untouched.
Ten years, because a recoupment demand arrives late.
Raw events are retained for a minimum of ten years. The archive is append-only at the database grant level: the application role holds no UPDATE and no DELETE permission on it. A policy is something a future engineer can forget. A missing grant is not.
A payer can come back years after the fill, and what ends the argument is a record that predates the question and demonstrably has not been edited since. That is what you are holding here, and it is the reason the archive sits underneath everything else.
What you get, and how long it takes.
- The raw archive, in the original content types, with the ingestion metadata alongside each payload. This is the part most vendors will not give you.
- Normalized events and every projection, as newline-delimited JSON, one file per entity, with a documented schema.
- Every document you uploaded, in the format you uploaded it, with its binding to the claim or case it belongs to preserved as data rather than as a folder name.
- The access log, so your record of who saw what survives your relationship with us.
Export is available at any time, not only on the way out, and asking for one is not a signal we treat as a churn event. If you want to reconcile our numbers against your own quarterly, that is a good instinct and we would rather you did.
What we will delete, and what we will refuse to.
- Your account and your people
- Deleted on request. Sessions end immediately and credentials stop working. Audit records of what those people did remain, because an audit trail that can be erased by deleting the actor is not an audit trail.
- Projections and derived data
- Deleted on request, at any time. Nothing is lost that cannot be recomputed.
- The raw archive, inside the retention window
- We will not delete it on request, and you should be suspicious of a vendor who offers to. It is your defence against a recoupment demand, and the entire value of it rests on the fact that neither of us can quietly remove an inconvenient record. After the retention window, it goes on request.
- A patient's data, on a valid request
- Handled under the terms of the business associate agreement, which governs this and takes precedence over anything on this page. Individual rights requests come to you as the covered entity, and we act on your instruction. See the BAA.
Ask for the export terms before you sign.
We would rather answer this at the start than at the end. Write to sales@attergo.com, or read the terms and the BAA in full.