Corgent
Waitlist

Switching and data export

Annex to the Terms of Service · Effective date: 16.10.2026

What this is about

This annex is part of the Terms of Service (clause 1). It implements Chapter VI of Regulation (EU) 2023/2854 (Data Act) and applies to all accounts and organisations, including free accounts and pilot access. In case of conflict it prevails over the rest of the Terms of Service; on data protection the Data Processing Agreement prevails. You can open, save and print this page before concluding the contract.

1. Switching request and notice period

You can request at any time that your data and digital assets be transferred to another provider or to your own IT infrastructure, or be deleted. You make the switching request in text form to mk@corgent.ai. The notice period is 14 calendar days. By its end you tell us which of the three options you choose and, when switching to another provider, the details we need for the transfer. Your right to terminate the contract under the Terms of Service remains unaffected; if you terminate without a switching request, sections 5 and 6 apply accordingly.

2. Transitional period

After the notice period ends, we complete the switch without undue delay and at the latest within 30 calendar days (transitional period). During this time the service continues to the agreed extent, we support you and the new provider reasonably, inform you of known risks to continuity and protect the data during the transfer according to the state of the art. If the switch is technically not feasible within 30 days, we inform you with reasons within 14 working days of the switching request and state another transitional period of at most seven months; the service continues. You may extend the transitional period once by a period you consider appropriate; only the regular usage fees apply, no switching charges.

3. Exportable data and formats

All data and digital assets that you or your organisation entered, uploaded or generated by using Corgent, including metadata, are exportable. Exhaustively, these are the following domains of the organisation export (schema 1.0.0):

  • Organisation: organisation, members with role and profile (email, display name, username), roles, chat allowances. JSON.
  • chats: chats and messages in plain text, the organisation's chat settings, artifacts with the current file. JSON and original files.
  • AI colleagues: colleagues with role, charter and standards, deployments, colleagues' connections, triggers. JSON.
  • Tasks: tasks with settings, runs with status, summary, actions and cost, approvals. JSON.
  • Skills: own skills with review state, each skill also as SKILL.md. JSON and Markdown.
  • Knowledge: knowledge bases, documents with metadata and full text, the uploaded original files, each document also as Markdown, sync sources without access tokens. JSON, Markdown and original files.
  • Connections: connected accounts and members' integrations with provider, account label, scope and status, without credentials. JSON.
  • Billing: billing profile, invoice purchases, refund requests, chat usage. JSON.
  • DATEV handovers: period, chart of accounts and counts per handover, plus EXTF booking batches and receipt images. JSON, CSV (EXTF) and ZIP.
  • AI literacy: completion records of the training. JSON.
  • Export history: the organisation's previous exports. JSON.

Not in the self-service export but exportable: conversations and visitor memory of the website widget, widget analytics, the admin audit trail and e-invoice documents, which we provide as JSON on request during the transitional period. Each member exports their personal data outside the organisation themselves (Profile, Privacy). Not exportable, because their disclosure would reveal Corgent's trade secrets and does not hinder switching (Art. 25(2)(f) Data Act): Corgent's system instructions, prompt templates and evaluation rules (your own instructions and settings are exported), source code, model configuration and internal routing rules, and security data whose disclosure would endanger other customers. Also not in the export are credentials for connected services, which you set up again with the new provider, and vector embeddings, which are model-specific; the text they were created from is exported instead.

4. How the export works

Organisation admins create the export themselves at any time in the web interface (Settings › Organisation, “Export all data”), free of charge and without a switching request. It is built in the background and available for download for 7 days; to prevent misuse, one export runs per organisation at a time and at most three in 24 hours, and during the transitional period we lift the limit on request. Beyond 100,000 rows per table or 300 MB of original files our support completes the export. There is currently no programming interface for the full export; individual domains such as runs, deployments and credit transactions are available through the REST API and the MCP server. On request we describe the structure of the data to the new provider and answer technical questions about the takeover. Known limitations: AI colleagues and tasks run on Corgent's runtime; another provider takes over instructions, settings and history, not the behaviour of Corgent's templates. Connections must be re-authorised with the new provider.

5. Retrieval period

After the transitional period ends you can continue to retrieve your data for at least 30 calendar days (retrieval period). During this time access is limited to the export; new runs and chats are no longer possible.

6. End of contract and deletion

The contract is deemed terminated once the switch has been completed successfully or, if you chose deletion, when the notice period ends; we confirm the end of the contract in text form. After the retrieval period we completely delete all exportable data and digital assets that you generated or that relate to you and confirm the deletion in text form. Technically this is done by deleting the organisation, which deletes its contents, files, memories, deployments and vault keys with it; the owner can also trigger it in the app (Settings › Organisation). Deleted data remains in backups until the hosting provider's backup period expires; backups are used only for restoration, and after a restore we apply the deletion again. Excluded is data we must retain under statutory obligations, in particular invoices and accounting records (§ 147 AO, § 257 HGB); it stays blocked without personal reference until the period expires.

7. Security during the switch

Only admins of the organisation in a signed-in session can create and download the export, and both are recorded in the organisation's audit log. The archive is stored encrypted and deleted after 7 days; it contains SHA-256 checksums for every file. The export contains decrypted content; keep it protected accordingly.

8. No switching charges

We charge no switching charges, including for data transfer (data egress), and no early termination penalties (Art. 29 Data Act). This applies already now, not only from 12.01.2027. Regular usage fees for the time until the end of the contract remain unaffected.

9. Register of data formats

Online register under Art. 26(b) Data Act. The export is a ZIP file with the following structure (format “corgent.organization-export”, schema 1.0.0):

  • manifest.json: format, schema version, export ID, organisation ID, creation time, domains with version, description, file, SHA-256 checksum and rows per collection, list of original files with size and SHA-256, warnings, content deliberately left out.
  • README.md: description of the archive in German and English.
  • data/<domain>.json: { domain, version, collections: { <name>: [rows] } } with the database columns in snake_case, contents decrypted, timestamps in ISO 8601 UTC.
  • files/<domain>/<path>: original files (knowledge documents, artifacts), knowledge as Markdown under files/knowledge/markdown/, skills as SKILL.md under files/skills/, DATEV files under files/datev_exports/.
  • Character encoding UTF-8; JSON per RFC 8259, a structured, commonly used and machine-readable format (Art. 30(5) Data Act).

If the structure of a domain changes incompatibly, we increase its version; if the archive layout changes, the schema version. Once the Commission publishes common specifications or harmonised standards for comparable services, we establish compatibility within twelve months (Art. 30(3) Data Act).

10. Infrastructure and government access

Information under Art. 28 Data Act. The ICT infrastructure on which Corgent stores and processes your data is located in the EU; some of the providers are, however, subject to US law:

  • Database, files and sign-in: Supabase, Inc. (USA), data centre in Frankfurt (AWS eu-central-1).
  • Application, background services, code sandbox and cache: Railway Corporation (USA), data centre in the Netherlands (GCP europe-west4); Railway stores the service logs (without contents, IP addresses only hashed) in the USA.
  • AI inference: OpenRouter, Inc. (USA) via the EU endpoint; executed by operators established in the EU (Microsoft Ireland, Amazon Web Services EMEA, Google Cloud EMEA, Mistral AI), in the sovereign tier only by EU-owned providers (STACKIT, IONOS, Scaleway, Mistral AI). The complete, live list with locations is at /subprocessors.
  • Keys of the credential vault: Scaleway SAS (France), EU data centre.
  • Email: Resend, Inc. (USA), EU region; error monitoring: Functional Software, Inc. (Sentry, USA), EU storage.

Providers established in the USA may be obliged under US law (such as the CLOUD Act) to hand over data even if it is stored in the EU. Our measures against this (Art. 32 Data Act): we additionally encrypt the contents of chats, documents and runs ourselves, and the keys of the credential vault are held by an EU provider; providers are contractually bound (DPA, standard contractual clauses); inference runs with zero data retention; we collect only the data we need. If we receive a request from an authority or court of a third country concerning your data, we assess it under Art. 32(2) and (3) Data Act, disclose only the minimum and inform you beforehand unless this is prohibited to preserve the effectiveness of a law enforcement activity.