Exit rights

Lock-in is usually described as an achievement. Carl Shapiro and Hal Varian put the strategy plainly in Information Rules in 1999: the value of an installed base is the aggregate switching cost of its customers, and the advice that follows is to raise it. A quarter of a century of software has taken that advice, and the result has a name in the customer’s vocabulary rather than the vendor’s. People stay on platforms they actively dislike because years of their records live inside them and the cost of getting out grows with every month they remain. The relationship survives on the arithmetic of departure rather than on anything anyone wanted.

Buyers with something to lose have started treating this as a procurement gate instead of a preference. They arrive at the first conversation asking not about features but about the last day: whether the whole thing can be exported onto infrastructure they control, whether they can keep operating it if the vendor disappears, what is deposited with whom and what releases it. It sounds like distrust and it is the opposite, because it is the precondition for extending any. The mechanism runs against the intuition, since a buyer weighing a long commitment is really pricing the worst case, so a proven exit takes the worst case out of the calculation and makes the commitment cheaper to make. You can leave, therefore you can safely stay.

Regulators arrived at the same place from the other side. The GDPR gave people a right to receive their data in a structured, commonly used, machine-readable format, and the EU Data Act now obliges cloud service providers to enable customers to switch and withdraws the charges that made switching expensive. What was once a competitive concession is turning into a floor, which means the vendors treating exit as a feature are working with a shrinking advantage.

Proven is the load-bearing word. An exit that has never been exercised is a hope with a doorway, the same failure the seed vault argument finds in archives, and it fails in the same ways: formats nobody can open, an inventory that does not match what is in the box, a restore that has only ever run on the machine that produced it. What proof looks like is unglamorous. A signed bundle with a complete inventory. A verifier the recipient runs from their own trusted copy rather than the one shipped inside the package, because a key carried in the box cannot vouch for the box. A rehearsal on a clean host where a lying installer and a self-attesting restore are required to fail. We build ours to that shape, and its honest status is engineering candidate rather than released, which is the sort of thing worth saying out loud, since an exit guarantee described more confidently than it has been tested is precisely the failure it claims to prevent.

The commercial consequence is that the moat moves. Where leaving is easy, retention has to be earned by the managed operating layer, the pace of the roadmap, and the judgment of the people running it, none of which can be accumulated by holding someone’s history hostage for long enough. That is a harder business and a better one, and the companies that set the cost of leaving to zero first will be the ones still trusted when everybody else is made to.