# What happens to our data if you go out of business?

*Published on 2026-10-13T00:00:00.000Z*

*By CipherStash Team*

You decrypt it and leave. Decryption is never charged, by design, so decrypting your whole dataset on the way out costs nothing from us. Decryption does need ZeroKMS, so plan the decryption inside your notice period. Enterprise agreements can include a guaranteed wind-down period and source code escrow, and we have agreed to both before. Key export, which will let you hold your authority key under your own KMS and decrypt with no dependency on us, is in development.

## Content

## Decrypt and leave

Available now. It is the migration you ran to adopt CipherStash, in reverse. Add plaintext columns, backfill them by reading and decrypting the encrypted values with the SDK's bulk decrypt, switch the application to the plaintext columns, then drop the encrypted ones. The SDK and Proxy both decrypt inside your environment, so nothing has to leave to be recovered.

We do not charge for any of it. Usage pricing counts encryption operations. Decryption is never charged, including every row you have ever encrypted read back in one migration. That is deliberate, so that leaving stays cheap. Your cost is compute and the engineering time to run it.

If you use Proxy, your queries never changed, so there is nothing to undo. With the ORM integrations, the query-layer changes were small going in and are the same size coming out.

## Plan it inside your notice period

Decrypting needs ZeroKMS to supply key material, so the decryption has to run while the service is available to you. Under our standard terms, cancelling takes effect at the end of your current subscription period, and access ends then. Run the decryption before that date.

Enterprise agreements are negotiated individually, and they can include a guaranteed wind-down period, during which the service keeps running after notice so you can decrypt and leave. We also offer source code escrow on enterprise plans. We have agreed to both before.

## Keep the data encrypted

Not yet. We are building key export. It will let you export your authority key, wrapped under a key you control in your own KMS, and combine it with the client key you already hold to derive data keys locally. You could then decrypt with no dependency on us, and with Stack Encrypt, which will be open source, keep encrypting and searching without re-encrypting anything. Neither key export nor Stack Encrypt has shipped. Plan around the first path until they do.

## Technical evidence

- [Pricing: decryption is never charged](/pricing)
- [Stack SDK reference](/docs/reference/stack)
- [Key management concepts](/docs/concepts/key-management)
- [Terms of use](/terms)

## Related notes

- [Can you see our data?](https://cipherstash.com/notes/can-you-see-our-data.md) — No. A data key needs an authority key held in ZeroKMS and a client key held by you. We have one of them, and plaintext never leaves your process.
- [Why wouldn't we just build this ourselves with KMS and a hash column?](https://cipherstash.com/notes/why-not-build-this-ourselves.md) — You could, and on the licence line it is cheaper. What you would then own is key management, rotation, audit, the production migration, and the cloud KMS bill that per-value keys generate.