Full export, whenever you want
A button inside the product exports your software's manifest and all of your data, in a documented format. No permission to request, no ticket to raise, no waiting period.
Reversibility written into the contract
SECURITY AND REVERSIBILITY
Your data stays yours.
Two questions come up at every first meeting: “what if you disappear?” and “is my data safe?”. Here are the answers, without spin, and what we commit to putting in the contract.
TWO FEARS, ADDRESSED HEAD-ON
“You're a small company. What if you disappear?”
Full export at any time, source-code escrow with a third party, reversibility written in black and white into your contract.
Your data and your continuity“Will my data really be safer than it is today?”
Roles down to the data level, encrypted secrets, an audit log, hosting in Europe. Compare that with fourteen spreadsheets travelling by email.
What we do, by designYOUR DATA AND YOUR CONTINUITY
If we disappear tomorrow, you keep everything.
Continuity is not a matter of trust: it is a matter of contract. Two clauses, in place from our very first client.
Source-code escrow
The engine's source code is deposited with a third-party escrow agent. We commit to this clause from our first client onwards: if Ghost Studio ceases trading, the code comes to you.
Contractual reversibility
Reversibility is not a sales argument: it is a clause in your contract, naming the export format, the escrow arrangement and the deadline for handing everything over.
Concretely, if Ghost Studio stops
The scenario you are worried about, step by step.
You keep the manifest
The full description of your software — entities, fields, views, roles, automations, indicators — in a readable file. It is the blueprint of your tool: another provider can pick it up.
You keep your data
Every record, its versions, its attachments and your users' roles, in that same export file. Nothing stays with us.
You get the code
The escrow agent releases the engine's source code under the terms of the contract. Your software can be brought back up on your own hosting.
None of these three points depends on our goodwill at the moment you need them. That is precisely what the clause is for.
EXPORT FORMAT
One single file, documented and versioned.
The export is a single JSON document, readable without Ghost Studio. Its format carries a version number: any breaking change bumps the number, never the content of your earlier exports.
Where is the button?
Inside your software, from your account menu: “Export (blueprint + data)”. The same button sits on the preview, in your Ghost Studio workspace. You click it yourself — no support desk involved. Every export is written to the audit log, like any other action.
The format is fully described in the product documentation (docs/EXPORT-FORMAT.md), handed over with the contract: value conventions field by field, and how to recreate the application elsewhere.
ghost-export-site-tracking-v3.jsonformat ghost-export/1
- manifestThe manifest
Entities, fields, views, roles, automations, indicators, navigation: the complete description of your software.
- versionsThe versions
Every version in order, with the change log and the patch applied at each step.
- entitiesYour data
All of your records, entity by entity, with their identifiers, their dates and their workflow state.
- usersYour users
The members of the application and each person's role.
- filesYour files
Attachments and their description: name, type, size, originating record.
CYBERSECURITY
What we do, by design.
No badge, no reassuring acronym: the list of what is actually in place in the product. Your IT team or your IT provider can check it point by point.
Roles and permissions down to the data
Each role sees what it must see, field by field. Anything not explicitly allowed is refused, and the refusal is logged. A record outside your scope is not findable, not merely hidden.
Encrypted secrets
The credentials of your connectors — mail, accounting, ERP — are encrypted in the database. They never travel to your browser, nor to an AI model.
An audit log of every action
Creations, edits, deletions, reads, exports, permission refusals: everything is timestamped and attributed. You know who did what, and when.
Backups and restore
Regular database backups and a restore procedure that is tested, not merely written down. The frequency and the recovery time are set out in the contract.
Hosting in Europe
Your database and your files are hosted in the European Union. No transfer outside the EU in the product's normal operation.
Antivirus on uploaded files
Every file uploaded into your software is scanned before it is stored, and is only served to the roles allowed to read the record it belongs to.
Robust sessions and sign-in
Sign-in by single-use, short-lived link, time-limited sessions, protected cookies. No password ever stored in clear text.
No data ever sold
Your data serves your software. It is never sold, never pooled with other clients', never used to train a model.
Compare that with today's situation
The question is not “is the risk zero?” — it never is. The question is: compared with what?
Fourteen spreadsheets
- The file leaves as an attachment, and nobody knows where it ends up.
- No roles: whoever opens the file sees everything, salaries and margins included.
- No trace: no way to know who changed which row, or when.
- The backup is a USB stick, or the laptop of whoever maintains the file.
Your Ghost software
- Data stays inside the application; exporting is a deliberate, logged action.
- Every role has its scope: a site foreman does not see a project's margin.
- Every action is timestamped and attributed, visible in the audit log.
- Regular backups, tested restores, hosting in Europe.
SUPPORT
A dedicated expert puts good practice in place.
The best architecture protects nothing if habits do not change. Your expert works on this with your teams during the project, not in a memo sent afterwards.
Roles are decided with you
Who sees what, who approves what: the role matrix is written during the scoping phase, with the people concerned, then applied in the software.
Teams are trained
Signing in, revoking access when an employee leaves, what to do with a suspicious email: it is part of the training, not an add-on.
Access is reviewed
An access and role review is scheduled at go-live, then at the rhythm we agree with you. When someone leaves, access is removed the same day.
What we will not tell you
We display no certification we do not hold, no compliance logo, no invented uptime figure. What you read on this page is what the product does and what the contract says — checkable, point by point, with your IT provider.
Have your IT providerread this page.
We are happy to answer their technical questions, and we hand over the export-format documentation before anything is signed.
Reversibility and escrow are in the contract from the first client onwards.