Leaving should be a decision, not a negotiation.
Every vendor says you own your data. Very few write down what that means in enough detail to be held to. This page is that detail: what we hold, for how long, who can reach it, and precisely what you get if you go.
Three layers, and only one of them is ours.
| Layer | What it is | Whose it is |
|---|---|---|
| Raw archive | The exact bytes your systems sent, with the time, principal, source address and content hash. | Yours. This is the layer that answers an audit, and it never changes. |
| Normalized events | Those bytes interpreted into a documented internal shape. | Yours. Derived from the archive and re-derivable at any time. |
| Projections | The views each product reads: priced fills, claims, cases, registers. | Ours to compute, yours to keep. Delete every projection and nothing is lost, because they can all be rebuilt from the archive. |
That third row is the point of the architecture. Because the durable truth is the archive rather than our interpretation of it, a change we make to how margin is calculated cannot corrupt your history. We re-run the projection and the record of what actually happened is untouched.
Ten years, and the reason is not compliance theatre.
Raw events are retained for a minimum of ten years. The archive is append-only at the database grant level: the application role holds no UPDATE and no DELETE permission on it. That is a stronger statement than a policy, because a policy is something a future engineer can forget and a missing grant is something they cannot.
The reason is defensive. A recoupment demand can arrive years after the fill, and the only thing that ends the argument is a record that predates the question and demonstrably has not been edited since. An archive you can rewrite is not evidence. It is a claim.
What you get, and how long it takes.
- The raw archive, in the original content types, with the ingestion metadata alongside each payload. This is the part most vendors will not give you.
- Normalized events and every projection, as newline-delimited JSON, one file per entity, with a documented schema.
- Every document you uploaded, in the format you uploaded it, with its binding to the claim or case it belongs to preserved as data rather than as a folder name.
- The access log, so your record of who saw what survives your relationship with us.
Export is available at any time, not only on the way out, and asking for one is not a signal we treat as a churn event. If you want to reconcile our numbers against your own quarterly, that is a good instinct and we would rather you did.
What we will delete, and what we will refuse to.
- Your account and your people
- Deleted on request. Sessions end immediately and credentials stop working. Audit records of what those people did remain, because an audit trail that can be erased by deleting the actor is not an audit trail.
- Projections and derived data
- Deleted on request, at any time. Nothing is lost that cannot be recomputed.
- The raw archive, inside the retention window
- We will not delete it on request, and you should be suspicious of a vendor who offers to. It is your defence against a recoupment demand, and the entire value of it rests on the fact that neither of us can quietly remove an inconvenient record. After the retention window, it goes on request.
- A patient's data, on a valid request
- Handled under the terms of the business associate agreement, which governs this and takes precedence over anything on this page. Individual rights requests come to you as the covered entity, and we act on your instruction. See the BAA.
Ask for the export terms before you sign.
We would rather answer this at the start than at the end. Write to sales@attergo.com, or read the terms and the BAA in full.