# Exit and data portability

Source: https://docs.settlemint.com/docs/deployment/exit-and-data-portability
Where a DALP instance keeps each kind of data, which exports it provides, what stays on your network, and how source access is agreed.

A DALP Instance keeps asset state on your ledger networks, operating records in the PostgreSQL database and object storage of its cluster, and signing keys with a custody provider or in the deployment's secret manager. Each location has its own export path, and the asset contracts keep running on your EVM network after DALP stops. SettleMint distributes the images and charts without source under a commercial licence, and source access or escrow can be agreed in a contract, as [Licence and source access](#licence-and-source-access) states.

## Where each kind of data lives [#where-each-kind-of-data-lives]

| Data | Where it lives | How you access it |
| --- | --- | --- |
| Asset contracts, balances, roles and events | The ledger networks in the instance's [networks](https://docs.settlemint.com/docs/deployment/networks) configuration. The contracts enforce the asset rules when a transaction executes. | Any node of the network, or the Platform API through the index. |
| The index, a PostgreSQL copy of those events that the Platform API reads | PostgreSQL. The index is derived from the network: it is rebuilt from blocks and events, and a chain reorganisation corrects it. See [Ledger Data](https://docs.settlemint.com/docs/concepts/records-and-evidence/ledger-data). | The Platform API and the [exports](#exports-the-platform-provides). |
| Operating records, such as filings and the audit trail | PostgreSQL. | The [exports in this page](#exports-the-platform-provides). For the database itself, your database provider's own export and backup tools. A database dump holds the platform's internal schema, which this documentation does not describe as an interchange format. |
| Files: asset documents, KYC documents, filing files, shareholder lists and investor statements | The object storage provider you configure. | The asset document, filing, KYC document and investor statement [downloads](#exports-the-platform-provides). For the storage itself, your storage provider's tools. |
| Console assistant conversations | PostgreSQL, deleted after `ASSISTANT_TURN_RETENTION_DAYS`, 365 days by default. When the assistant is on, questions and their context also go to OpenRouter. | Not exported. |
| Cache and wake-up messages, which tell a process to re-read state | Redis. It is not a system of record. | Not exported. |
| Signing keys | With the default `local` signer, in the deployment's secret manager. The default `local` secret manager keeps them as encrypted rows in PostgreSQL. The `aws`, `gcp`, `azure` and `vault` managers hold them in that service. With a custody provider, at that provider. | A custody provider's own tools. With the `local` signer and `local` secret manager, your PostgreSQL backups and the master password that decrypts them. With another secret manager, that service's own tools. |

In production, PostgreSQL, Redis and object storage are services you supply and back up. You set PostgreSQL and Redis in `global.datastores` and object storage in `global.dalpApp.config.objectStorage`. [Prerequisites](https://docs.settlemint.com/docs/deployment/prerequisites) lists each dependency and [Backup and disaster recovery](https://docs.settlemint.com/docs/deployment/backup-recovery) covers what DALP backs up and what your providers must back up. If SettleMint operates the cluster for you, the same stores sit in that cluster, and [Hosting and access](https://docs.settlemint.com/docs/deployment/hosting-and-access) explains why cluster access always means data access.

## What you depend on [#what-you-depend-on]

DALP runs from container images and Helm charts under the terms in [Licence and source access](#licence-and-source-access).

| Dependency | What it is |
| --- | --- |
| The DALP platform | The Console, the Platform API and the index, which you run from the images and charts. |
| SettleMint | The images at `ghcr.io`, the chart at `pkg.distribution.settlemint.com`, patch releases and security fixes. Mirror the version you run, because new versions and fixes need continued access. |
| Ledger network | EVM networks that you configure and connect to with your own endpoints. |
| Database | PostgreSQL. |
| Object storage | AWS S3, Google Cloud Storage, Azure Blob Storage, another S3-compatible service or a filesystem path. |
| Cache | Redis. |
| Signing | The `local` signer, or a custody provider you select. |
| Integration surface | The OpenAPI contract at `/api/v2/spec.json`, from which you can generate a client. |

## Exports the platform provides [#exports-the-platform-provides]

Each export is a separate download from the Console or the Platform API, as CSV, XLSX, PDF, JSON, ZIP, XML or the file as uploaded. No single export covers everything: the ledger holds balances and events, the holder register export gives positions at a block, and the audit trail export gives operating history. Asset and KYC documents download one at a time.

| What you export | Format | Where |
| --- | --- | --- |
| Resources the Platform API serves | JSON, except the file downloads in this table | `/api/v2`, with its OpenAPI contract at `/api/v2/spec.json`, and the legacy `/api/v1` that existing clients keep using. |
| The rows of a Console table | CSV or JSON | The table's "Export as CSV" and "Export as JSON" menu items. A table paged by the server fetches every matching row. Some Console pages replace this menu with their own export action, and some remove it. |
| A token's activity | CSV | "Export CSV" on the token's activity table, which exports every event that matches the filters, with times in UTC. The API route is `GET /api/v2/tokens/{assetId}/events/export`. |
| The holder register as at a chosen record block | CSV, XLSX or PDF | "Holder register…" in the holders table's Export menu. The API route is `GET /api/v2/reporting/shareholder-lists/{tokenAddress}/download`. |
| The holder register in the registrar layout | CSV | "Registrar file…" in the same menu, with columns `holderWallet`, `identityReference`, `jurisdiction` and `quantity`. The API route is `GET /api/v2/reporting/shareholder-lists/{tokenAddress}/registrar-file`. |
| Stored shareholder list deliveries | CSV, XLSX and PDF editions | "Issuer deliveries…" in the same menu. A download returns the stored file only after its length and digest match what was recorded. |
| An investor statement | CSV, XLSX or PDF, set by the statement policy | The download button for each format on the Console Statements page, or the statements routes under `/api/v2/reporting/statements`. The default policy produces CSV and PDF. A download link is valid for 15 minutes. |
| A transaction confirmation | CSV or XLSX | The confirmations routes under `/api/v2/reporting/confirmations`. |
| The audit trail for a time range | CSV | "Export" on the Reporting audit trail page, or `GET /api/v2/reporting/trail/export`. |
| The daily transaction report | CSV or XLSX | "Download report" on the Console Daily transactions page, or `POST /api/v2/reporting/daily-transactions`, which returns the file for a range of at most 31 days. |
| The stored files of a filing | CSV, XLSX, ZIP, JSON, XML or PDF, set by the obligation | The [Filings](https://docs.settlemint.com/docs/console/reporting/filings) page. Each part has its own link, valid for 15 minutes. |
| An asset document | The file as uploaded | The document's download action, or `POST /api/v2/tokens/{assetId}/documents/{documentId}/downloads`, which returns a signed link. |
| A KYC document | The file as uploaded | `POST /api/v2/kyc-profile-versions/{versionId}/documents/{documentId}/downloads`, which returns a signed link. |

Filing files expire. A filing keeps its files for the retention class its obligation sets, which is five, seven or ten years from acceptance, or indefinite. The platform erases the files when the period ends, but not while any legal hold on the filing is unreleased, so download any filing you must keep beyond that.

The holder register, registrar file, deliveries, audit trail and daily transaction exports are open to the reporting readers: the system roles `admin`, `auditor`, `complianceManager` and `systemManager`, the organisation owner, and a platform administrator. Downloading the files of a filing needs the organisation owner or a platform administrator. Statements and confirmations cover only the caller's own wallets, whatever the caller's role.

To keep a downstream copy of changes as they happen, register a webhook endpoint. The platform delivers the events that match the endpoint's subscriptions, with retries. See [Webhooks](https://docs.settlemint.com/docs/api-reference/webhooks). To read large result sets through the API, see [Pagination](https://docs.settlemint.com/docs/api-reference/guides/pagination).

## What stays on the ledger network [#what-stays-on-the-ledger-network]

Stopping the platform does not stop the contracts. The asset contracts, their balances and their role assignments remain on the network. The contracts keep enforcing their role checks, and apply the compliance modules to mints and transfers, on every call from any tooling. Forced updates, such as recovery transfers, skip the compliance modules but still require a registered recipient, and a verified one on V2 tokens with a V2 identity registry. The platform's authorisation, wallet verification and signing policy govern only the requests made through the platform.

An exit depends on who controls the keys of the role-holding wallets. A self-custody holder signs with their own wallet. For a managed wallet, the key sits at the custody provider the organisation chose. With the default `local` signer, the keys sit in the deployment's secret manager. The default `local` secret manager stores them as encrypted rows in PostgreSQL, under the master password you generated, so the signing keys in a PostgreSQL backup are readable only with that password.

Store that password with your other secrets for as long as you keep the backups. Data encrypted under a lost password is unreadable. To replace the password, follow the rotation steps in [Values and secrets](https://docs.settlemint.com/docs/deployment/install/values-secrets#encryption-at-rest). See [Security and compliance posture](https://docs.settlemint.com/docs/deployment/security-compliance-posture) for the custody layers.

The network endpoints are yours as well. You supply the RPC or ledger endpoints for each enabled network, so reading the chain needs nothing from SettleMint.

## Steps to leave [#steps-to-leave]

These steps assume you operate the cluster. If SettleMint operates it, SettleMint holds the database, the object storage and the master password, and with the default `local` signer those three hold the signing keys of every platform-managed wallet. Steps 3 and 5 then need SettleMint to deliver a database export, the stored files and the master password, and step 4 removes the platform's ability to sign for your roles. [Cluster access means data access](https://docs.settlemint.com/docs/deployment/hosting-and-access#cluster-access-means-data-access) explains why.

1. Mirror the images and the chart of the version you run into your own registry, so a pod can still reschedule if your access to the published registries ends.
2. Run the [exports](#exports-the-platform-provides) for every record you must keep, starting with filings whose retention period is about to end.
3. Back up PostgreSQL and the object storage, or the filesystem volume if you use one, with your providers' own tools.
4. Confirm who controls each role-holding wallet. For a role you still need on a wallet whose key the platform or a custody provider holds, grant that role to a wallet whose key you hold.
5. Store the master password with your secrets for as long as you keep the PostgreSQL backup from step 3.
6. Point your own tooling at the RPC endpoints of each network.
7. Stop the platform.

## Licence and source access [#licence-and-source-access]

SettleMint distributes DALP as container images and Helm charts under its commercial licence, without the source code. Access to the DALP source code, or escrow of it, can be agreed in a contract with SettleMint.

## Next steps [#next-steps]

- [Backup and disaster recovery](https://docs.settlemint.com/docs/deployment/backup-recovery) for the stores that hold the operating records.
- [Prerequisites](https://docs.settlemint.com/docs/deployment/prerequisites) for the master password, the signer and the object storage choices.
- [Issuer shareholder list](https://docs.settlemint.com/docs/api-reference/guides/issuer-shareholder-list) and [Investor statements](https://docs.settlemint.com/docs/api-reference/guides/investor-statements) for the two export families with their own API guides.