Data Portability Charter

Data Portability Charter

Version 1.0 · Effective 2026-05-27

Your data is yours. This charter sets out specific, durable practices StationWorks commits to for keeping it that way. It is incorporated by reference into the Terms of Service; the commitments below are binding terms of that agreement and may only be made stronger, never weaker, without 60 days' notice.

The commitments here are written as a single contract that applies both to what Mobilize does today and to capabilities still being built. Where a commitment refers to a record type or export format not yet wired up, it is a binding forward commitment: as we ship each capability, it will meet these standards. The Current status section at the bottom of this page lists what is live today.

Continuous export availability

While your subscription is active, you can export your data through the application at any time — no support ticket, no fee, no new agreement. As each record type is wired into the export pipeline, it becomes available through the same on-demand path.

Machine- and human-readable formats

Each record type, as it is wired into the export pipeline, will be exportable in at least one machine-readable and one human-readable format from this list:

• Machine-readable: CSV (tabular records) and JSON (canonical structure), with schema documentation describing every field.
• Human-readable: PDFs for incident records, apparatus records, personnel records, region info (county / agency / contact rosters), and audit log entries.

See Current status for which record types and formats are live today.

Open formats only

No proprietary containers or encoded blobs. JSON, CSV, and PDF are readable by standard tools indefinitely, with or without us.

Verifiable integrity

The audit log is append-only and hash-chained at the database layer: each entry's hash covers the previous entry's hash, and database triggers block any UPDATE or DELETE against audit rows. Today, integrity is verified with an operator tool that walks the chain and reports any break. We commit that when audit log export ships, the export format will include the raw hash and prev-hash bytes alongside the canonical JSON used to compute each hash, with a published verification spec, so the chain is verifiable offline using standard tools.

Format stability

Once an export format is published, we will not make backwards-incompatible changes to it without 90 days' notice and a migration guide. Each published export format carries a schema_version field; old versions remain documented.

Post-cancellation grace period

For 180 days after cancellation, you retain full export access through the application. After that, we provide one final export on request at no charge. (Mobilize is currently pre-billing; this commitment governs the cancellation flow whenever paid subscriptions go live.)

No artificial friction

We will not throttle, gate, or paywall exports. They run on the same infrastructure as the rest of the product.

Shutdown notice

If StationWorks ever stops operating Mobilize, we will give at least 120 days' notice and provide a final export window before any data is destroyed.

What the export will contain

• Records: mobilization / incident records, personnel records, apparatus records, qualifications, agency and region data.
• Audit log: the complete hash-chained log of every state change, with the verification chain.
• Files: original uploaded attachments (PDFs, photos, documents).
• Configuration: your organization's rotation policies, contact preferences, role assignments.

Changes to this charter

Changes that strengthen these commitments take effect on publication. Changes that weaken any commitment — or that materially reduce a user's rights under this charter — require at least 60 days' notice, delivered both by email to each agency administrator on file and as an in-application notice visible to users in the affected agencies. The prior version of this charter remains accessible during the notice period, and you may export your data under the prior terms at any time during that window.

What we don't promise

We don't promise to operate Mobilize forever — but we promise the shutdown notice and final export described above. We don't host your exports indefinitely; storing and backing them up is your responsibility once delivered.

Current status

As of 2026-07-07, the following are live:

• Apparatus records: CSV and PDF export, on demand.
• Audit log integrity verification: available via the mobilize audit verify operator tool. Offline verification format is a forward commitment per the Verifiable integrity section.
• Per-record retention class (permanent / 6yr / 3yr / 1yr) and per-field disclosure tagging: applied at write time on every record, so future export and redaction paths inherit the metadata they need.

The following are committed but not yet built:

• JSON export format (CSV ships first).
• PDF and CSV export for incident, personnel, region, and audit log records (apparatus ships first).
• Offline-verifiable audit chain format (raw hash and prev-hash bytes plus canonical-JSON spec).
• Subscription cancellation flow with the 180-day grace period.

As each item ships, this section will be updated. The commitments in the sections above apply to every item, live or forthcoming.

Contact

Questions about this charter: support@stationworks.io.