Data Portability Charter

Data Portability Charter

Version 1.0 · Effective 2026-05-27

Your data is yours. This charter sets out specific, durable practices StationWorks commits to for keeping it that way. It is incorporated by reference into the Terms of Service; the commitments below are binding terms of that agreement and may only be made stronger, never weaker, without 60 days' notice.

The commitments here are written as a single contract that applies both to what Mobilize does today and to capabilities still being built. Where a commitment refers to a record type or export format not yet wired up, it is a binding forward commitment: as we ship each capability, it will meet these standards. The Current status section at the bottom of this page lists what is live today.

Continuous export availability

While your subscription is active, you can export your data through the application at any time — no support ticket, no fee, no new agreement. As each record type is wired into the export pipeline, it becomes available through the same on-demand path.

Machine- and human-readable formats

Each record type, as it is wired into the export pipeline, will be exportable in at least one machine-readable and one human-readable format from this list:

• Machine-readable: CSV (tabular records) and JSON (canonical structure), with schema documentation describing every field.
• Human-readable: Excel spreadsheets (Office Open XML) with a written guide to every sheet and column, or PDFs, for incident records, apparatus records, personnel records, region info (county / agency / contact rosters), permit records, and audit log entries.

See Current status for which record types and formats are live today.

Open formats only

No proprietary containers or encoded blobs. JSON, CSV, PDF, Excel workbooks (Office Open XML, ISO/IEC 29500) and zip archives are readable by standard tools indefinitely, with or without us.

Verifiable integrity

The audit log is append-only and hash-chained at the database layer: each entry's hash covers the previous entry's hash, and database triggers block any UPDATE or DELETE against audit rows. Where a product's audit log is in the export, the export includes the raw hash and prev-hash of each entry alongside the exact canonical text used to compute each hash, with a published verification spec, so the chain is verifiable offline using standard tools. An entry that also names another district keeps its place, its links and its hash, and its text is withheld. Until a product's audit log is in the export, its integrity is verified with an operator tool that walks the chain and reports any break. See Current status for which are live.

A district archive is signed. Its manifest lists the SHA-256 hash of every other file in the archive, and StationWorks signs the manifest, so one signature covers the whole archive and shows it is the one StationWorks produced. The signature is checked offline, with standard tools, against our published public key. If we ever replace that key, the old one stays published, so an archive you already hold still checks.

Format stability

Once an export format is published, we will not make backwards-incompatible changes to it without 90 days' notice and a migration guide. Each published export format carries a schema_version field; old versions remain documented.

Post-cancellation grace period

For 180 days after cancellation, you retain full export access through the application. After that, we provide one final export on request at no charge. (Mobilize is currently pre-billing; this commitment governs the cancellation flow whenever paid subscriptions go live.)

No artificial friction

We will not throttle, gate, or paywall exports. They run on the same infrastructure as the rest of the product.

Shutdown notice

If StationWorks ever stops operating Mobilize, we will give at least 120 days' notice and provide a final export window before any data is destroyed. While we operate the Service, sealed audit-log segments are held in write-once storage and cannot be altered or deleted early — that is our tamper-evidence guarantee, not a promise to warehouse your records for you. On wind-down, the notice and final export above apply to the audit log too: you receive the complete chain and the data needed to verify it, and your agency — as records custodian — is responsible for retaining it under the schedule that applies. See the Privacy Policy for how that storage works.

What the export will contain

• Records: mobilization / incident records, personnel records, apparatus records, qualifications, agency and region data.
• Audit log: the complete hash-chained log of every state change, with the verification chain.
• Files: original uploaded attachments (PDFs, photos, documents).
• Configuration: your organization's rotation policies, contact preferences, role assignments.

Changes to this charter

Changes that strengthen these commitments take effect on publication. Changes that weaken any commitment — or that materially reduce a user's rights under this charter — require at least 60 days' notice, delivered both by email to each agency administrator on file and as an in-application notice visible to users in the affected agencies. The prior version of this charter remains accessible during the notice period, and you may export your data under the prior terms at any time during that window.

What we don't promise

We don't promise to operate Mobilize forever — but we promise the shutdown notice and final export described above. We don't host your exports indefinitely; storing and backing them up is your responsibility once delivered.

Current status

As of 2026-10-09, the following are live:

• District archive: a district administrator builds it on demand from the StationWorks console, under Settings, Data export. It is one zip holding spreadsheets (Excel, Office Open XML) for people to read, the same tables as JSON for software, and a guide describing every sheet and column. The JSON carries a schema_version, now 1. The archive holds:
  • the district's people and their roles and access;
  • each signed Terms of Service, as the original PDF;
  • burn permit records: every permit, unfinished applications, permit types, rules, burn status, excluded areas, settings and translations;
  • the audit log, in a readable form and in the verifiable form below.
• Offline-verifiable audit chain: the archive carries the district's audit chains for the console, burn permits and water sources, with the raw hash and prev-hash of every entry, the exact canonical text each hash covers, a written verification spec, and two short programs that check the chain, one needing only Node.js and one only Python. One kind of entry is the exception: an entry that also names another district keeps its place, its links and its hash, and its text is withheld, so its own hash cannot be recomputed from the archive. The chain file carries a schema_version, now 1.
• Signed archive: the archive's manifest lists the hash of every file, and StationWorks signs it. The archive says how to check both, and the public key is published here.
• Burn permit list: CSV, Excel or JSON, on demand, for the permits a district's filters match. This single file is not signed.
• Apparatus records: CSV and PDF export, on demand, in Mobilize.
• Per-record retention class (ranging from one year to permanent) and per-field disclosure tagging: applied at write time on every record, so export and redaction paths inherit the metadata they need. The archive's manifest lists each column's disclosure class.

The following are committed but not yet built:

• Mobilize records in the district archive: mobilization and incident records, personnel, qualifications, apparatus, and agency and region data. Apparatus is exportable today from Mobilize itself.
• Mobilize's audit log in the offline-verifiable format. Mobilize chains its audit log by region, so one district's entries are not a chain on their own. Until this ships, its integrity is checked with the mobilize audit verify operator tool.
• Water source records in the district archive.
• PDF as a human-readable format for records and audit log entries.
• Original uploaded attachments other than signed Terms of Service.
• Subscription cancellation flow with the 180-day grace period.

As each item ships, this section will be updated. The commitments in the sections above apply to every item, live or forthcoming.

Contact

Questions about this charter: support@stationworks.io.