Data export and switching providers

1. What this page is for

This page explains, publicly and before you sign up, how the Customer can get its data back and switch to another provider or to its own infrastructure, as required by Regulation (EU) 2023/2854 (Data Act, Articles 23 to 31) and the right to data portability in Article 20 GDPR.

The binding terms are in the Terms of Service and the Data Processing Agreement; if anything here differs, they prevail.

2. Export at any time

Anyone with the organization's owner role (OWNER) can download a full JSON export from Settings at any time, including during the thirty days after requesting deletion.

Every export is recorded in the organization's audit log (who and when).

In addition, the panel lets you download separately:

• findings as CSV;
• reports as PDF;
• invoices as PDF, one by one or in a ZIP;
• on plans that include it, data through the public API.

3. Export format (nextanalyzer-export, version 1)

It is a single UTF-8 JSON document with these fields:

• format: always "nextanalyzer-export".
• version: format version (currently 1). If the shape of the document changes, the version goes up and is published here.
• exportedAt: date and time of the export (ISO 8601, UTC).
• organizationId: the organization identifier.
• tables: an object with one entry per database table that holds the organization's data; each entry is a list of rows and each row an object keyed by the database column names (snake_case).

Dates are ISO 8601, amounts are decimal strings and structured fields are JSON objects. Identifiers are UUIDs and link tables to each other just as in the database, so the document can be loaded into another system without losing relationships.

4. What it includes

Everything that belongs to the organization: the organization itself and its subscription, members (name, email, language and role) and invitations, groups and devices with their inventory and snapshots, aggregated metrics, vulnerabilities and configuration findings, alerts, rules and notifications, remediations, scripts and their versions, remote access sessions (without screen content), network discovery, reports, AI analyses, the activity history if it was enabled, support conversations (only the messages visible to the Customer), branding, billing and the audit log.

Tables that depend on the above are also included (for example, the messages of a conversation or the devices of a remediation).

5. What it does not include and why

• Secrets and credentials: passwords and their hashes, tokens, keys, SSO and webhook secrets and any sealed data. They are not Customer data but the way the service protects it; the Customer must set them up again with the new provider.
• Internal notes by NextAnalyzer's support team.
• Each person's sign-in sessions (with their IP and browser): they are that person's data, not the organization's.
• Files (report PDFs, branding images and support attachments), which are downloaded from the panel; the JSON only contains their descriptive data.
• Raw events from the detection engine, which are only kept for 90 days for troubleshooting.

6. How to request a switch

The Customer can ask to switch to another provider or to its own infrastructure by writing to [PENDING: email] from the owner's account, stating the destination if known. The maximum notice period is two months.

From the request:

• A transition period of thirty calendar days during which the service keeps working and the Customer can export as many times as needed. If that is not technically feasible, the Customer will be told within fourteen working days with the reasons, and it can be extended up to seven months.
• The Customer may extend the transition period once if needed.
• Afterwards, the Customer has another thirty days to retrieve the data, after which it is erased, including backups in their ordinary cycle, except what the law requires to be kept blocked. On request, erasure is certified.

Switching is free of charge: no fees for data egress or for assistance.

7. Where the data is and access by authorities

The infrastructure that processes the Customer's data is in the European Union ([PENDING: hosting provider and country]). The providers involved are listed in Annex III of the Data Processing Agreement.

If an authority of a non-EU country asked for access to the Customer's non-personal data without an international agreement covering it, NextAnalyzer will object to the extent permitted by law, ask for the international agreement route, inform the Customer unless prohibited and hand over only the strict minimum (Article 32 Data Act).