Switching Provider under the EU Data Act

Introduction 

In compliance with articles 26 and 28 of the EU Data Act (Regulation (EU) 2023/2854), this disclosure:

1. outlines the methods and procedures for Upsun customers to switch to another service provider or migrate data to their own on-premises infrastructure, and 
2. provides information on the jurisdiction governing the Upsun Platform and the protective measures against international governmental access to customer content.

1. Available Switching & Porting Methods

1.1. Self-Service Portability.

Customers can access and export data through the following mechanisms:

• Management API: Upsun exposes a comprehensive REST API covering the full lifecycle of organizations, projects, environments, deployments, and configuration. The API is documented via OpenAPI specifications and publicly available at: https://docs.upsun.com/api/ 
• Command Line Interface (CLI): The Upsun CLI provides programmatic access to platform resources and allows customers to retrieve configuration, metadata, logs, and environment information using API-backed commands: https://docs.upsun.com/administration/cli.html 
• Git Repository Access: Application source code and configuration stored on Upsun is accessible via Git. Customers can retrieve the full repository history using standard Git operations.
• Service-Level Data Export: Persistent services (such as databases or other stateful services) can export their stored data using standard service-specific tools and formats. Documentation for exporting data is available at:  https://docs.upsun.com/learn/tutorials/exporting.html 

1.2. Data Transport

Exportable data may be transferred by customers using common secure methods including:

• Secure download via HTTPS and SSH
• Secure file transfer protocols (sFTP)
• Git repository synchronization

2. Data Formats & Interoperability Specifications

Upsun enables data portability using widely-adopted open formats and protocols.

2.1. Exportable Data Categories

Customer data that can be exported includes, but is not limited to:

• Application source code and configuration files repositories
• Persistent service data and stored files
• Project, organization, and environment metadata
• Logs
• Backups
• Environment variables and routing configuration

A full inventory of data categories is maintained in the Upsun Data Register, available at: https://developer.upsun.com/docs/registry

2.2. Technical Formats

Exported data may be retrieved in commonly used technical formats including:

• Git repositories (source code and history)
• JSON (API responses and configuration metadata)
• YAML (application and infrastructure configuration)
• SQL dumps or database-native export formats for relational databases
• CSV or text formats for certain logs and datasets
• Binary archives for backups

These formats are widely supported by common development tools and cloud environments.

2.3. Standards Compliance

Upsun relies on widely adopted open standards and protocols, including:

• Git distributed version control system
• REST APIs documented using the OpenAPI specification
• Standard database export formats for supported database engines
• HTTPS for secure data transport

3. Technical Restrictions & Known Limitations

While Upsun supports customer data portability, certain technical characteristics of cloud-native platforms may affect migration workflows.

3.1. Volume Limits

Upsun does not impose platform-specific restrictions on the volume of customer data that can be exported. However, exports may be subject to:

• network bandwidth limitations
• resource constraints of the originating environment
• service-specific export mechanisms

3.2. Transformation Requirements

Some exported data may require reconfiguration before being used in another environment. Examples include:

• environment-specific configuration values
• infrastructure definitions referencing Upsun-specific services
• deployment configuration files tailored to Upsun’s build and runtime model

3.4. Compatibility

Upsun supports widely adopted open formats and standards to maximize portability. However:

• infrastructure definitions written for Upsun may require adaptation when deployed on other cloud providers
• service configuration may need adjustment depending on the destination platform’s capabilities
• some operational metadata used internally by Upsun is platform-specific and may not be applicable in external environments

These limitations are typical for platform-as-a-service environments and do not prevent customers from exporting their application data and code.

4.  Continuity and Support

• Uptime and Support Levels: Throughout the switching process, Upsun will maintain full service operation and data access  and the uptime and support level as detailed in the Service Specific Terms or as agreed upon in the customer contract.
• Assistance: The Upsun support team provides commercially reasonable assistance, focusing on guiding the customer with self-serve migration and data export using Upsun-provided tools. Migration services are not included; however, advanced migration assistance is available upon request for an additional fee. 

5. The Switching Process & Timeline

Customers who fall within the scope of the EU Data Act can inform Upsun of their request to switch providers or delete data at any time, provided they give two months' notice. This can be done by filling out the switching request form, available at https://upsun.com/trust-center/legal/eu-data-act-switching-request/, and submitting it to Upsun's support team.

The switching process is subject to the notification and timelines set out below:

• Notice Period: 2 months
• Transition Period: 30 days, extendable once by customer upon written notice to Upsun’s support team. 
• Data Retrieval period: 30 days
• Data Erasure:  Upsun may permanently delete Projects subject to the switching or data deletion request upon confirmation of successful completion of switching from the customer or upon expiry of the data deletion request notice period.

Note: Transition Period and Data Retrieval Period will be waived in case of data deletion request.

 6. Financial Terms 

• Continuity of Service Fees: Upsun maintains full service operation and data access throughout the switching process (including the Data Retrieval Period). The customer is responsible for and must pay all recurring fees and charges for Upsun services until the switching process is successfully completed or data is erased.
• Early Termination Penalties:  Customers who fall within the scope of the EU Data Act will be exempt from payment of recurring service fees or spend commitments otherwise due for the remainder of their contract term, following successful completion of the switching process or data erasure.

However, an early termination penalty fee will apply, consisting of the following components:

(i) Total Discounted Amount: The sum of all discounts, if any,  applied from the contract's inception up to the early termination date.

(ii) Base Fee: 30% of the remaining undiscounted contract amount from the early termination date until the end of the original contract term.

(iii) Customisation Fee (if applicable): The full, undiscounted contractually-agreed fee for bespoke development, configuration, integration, or other technical or functional tailoring of the services specifically for the customer.

For the avoidance of doubt, customers who do not fall within the scope of the EU Data Act  are not subject to the early termination penalty set forth above but remain responsible for the payment of all recurring service fees or spend commitments for the remainder of their contract term.

7. Infrastructure Jurisdiction

• The ICT Infrastructure is subject to the laws of the country where the ICT Infrastructure is located. Customers determine the location of the ICT Infrastructure when electing a hosting region for their project: https://docs.upsun.com/development/regions.html.
• Sub-Processor locations: https://upsun.com/trust-center/privacy/subprocessor-list/.

8. Security Measures and  Protection Against International Governmental Access

• Security Measures: Security measures described in the relevant security and privacy sections in our Trust Center shall apply throughout the duration of the contract  and the switching process.
• Law Enforcement Requests. Upsun will usually inform customers if authorities request their data unless prohibited by law. If Law Enforcement Authorities wish to restrict customer notification, they should provide a court order or legal authority preventing Upsun from informing the customer.