# Customer Export & Offboarding — Commercial Pilot

Guidance for exporting customer data and decommissioning a single-tenant installation.

**Not legal advice.** Align with customer contract, GDPR/DPA, and retention policies.

## Export package contents

| Asset | Location / method |
|-------|-------------------|
| Database | `scripts/backup_database.sh` → `.sql.gz` |
| Evidence files | `scripts/backup_evidence.sh` → `storage/private/` + `uploads/` tarball |
| Organisation identity | `organisation_settings`, `installations` rows |
| Activity / audit | `activity_log` table (export via SQL or admin reports) |
| Release history | `release_records`, `VERSION.txt`, `MANIFEST.sha256` |

## Recommended export procedure

1. Put portal in read-only mode (maintenance or disable write roles).
2. Run full backup: `bash scripts/backup_full.sh`.
3. Export CSV/PDF reports as required (inspection packs, training matrix, stock register).
4. Provide customer with:
   - DB dump
   - Evidence tarball
   - `installation_id` and final `product_version`
   - List of admin users (emails only; no password hashes in customer pack unless contract requires)

## Integrity verification

Customer may verify evidence using `sha256` on `evidence_attachments` (migration 287+):

```bash
EVIDENCE_CHECK=1 SRC_DB=customer_db bash scripts/prove_restore.sh
```

## Offboarding / deletion

After handover retention period:

1. Revoke DNS / SSL / hosting access.
2. Securely delete DB, `storage/private/`, backups, and config secrets.
3. Remove API keys / SMTP / ClamAV credentials from password vaults.
4. Record destruction date in internal CRM (not in deleted portal).

## Sub-processors

Document any third-party services used (email, AV scan host, backup storage) in customer DPA annex.
