Lock-in is not usually created by anybody acting badly. It accumulates from small conveniences: an account set up under the supplier's login, a system nobody documented, data in a format only one product reads.
By the time it matters, unwinding it is a project.
The four kinds
Data
The most consequential. If you cannot get your data out in a usable form, you cannot leave regardless of anything else.
"Can I export?" is insufficient. The questions that matter: can I export everything, including attachments, notes, history and custom fields; in what format; are relationships preserved so I can tell which note belongs to which record; can I do it myself; and how long does it take?
Attachments are where the trap usually is. Many systems export records cleanly and leave documents behind.
Knowledge
A system only one supplier understands. No documentation, unconventional technology, code nobody else could pick up.
This is often unintentional — documentation is the first thing dropped when a budget is tight — and it is just as binding as a contract.
Contractual
Long terms, automatic renewal with short cancellation windows, exit fees, or an undefined handover process.
The undefined handover is the common one. A contract that says nothing about what happens on termination leaves you negotiating during a breakdown, which is the worst possible position.
Process
Your way of working built entirely around one product's assumptions. Changing supplier means changing how the business operates, which is a far larger project than changing software.
The hardest kind to see and the hardest to unwind.
Ask what would happen if you gave notice tomorrow. If you cannot answer specifically, you have found your exposure.
Questions before signing
- Who owns the code, and is that in writing?
- Who owns the data, and how do I extract all of it?
- Is hosting in an account in my name?
- What is the exit process, and how long does it take?
- Is there a charge for export or handover?
- What documentation will I hold?
- What is the notice period, and how does renewal work?
- If you were unavailable, who else could support this?
None of these are unreasonable, and the manner of the answers is as informative as the content. A supplier who answers immediately and specifically is a supplier who has thought about it. Discomfort is itself the answer.
Checking what you already have
For each significant supplier, establish:
Can you log in to the hosting and the domain registrar yourself? If not, you do not control your own infrastructure — see who owns your website.
Do you hold a current copy of your data? Not just in their system. Export it and open it. Twenty minutes, and it tells you exactly where you stand.
Do you have documentation? Enough that a competent stranger could understand what exists.
Are the accounts around the system yours? Analytics, payment providers, email platforms, certificates.
Does your contract say what happens on exit?
Most businesses score poorly on this audit and most suppliers are entirely willing to fix it when asked. Framing it as governance rather than distrust makes the conversation straightforward — insurers and auditors ask about exactly this.
Reducing exposure without disruption
Take an export regularly. Monthly or quarterly, stored somewhere you control. It also serves as a backup, which is a second reason to do it.
Get accounts into your name. Add the supplier as a user rather than the reverse. Usually a two-minute change.
Ask for documentation as a deliverable. On the next piece of work, make it part of the scope rather than a favour.
Prefer conventional technology. Not the place for novelty, because the pool of people who can help matters more than elegance.
Keep integrations at the boundaries. Systems connected through documented interfaces are easier to replace individually than systems fused together — see how systems talk to each other.
Accepting it deliberately
Some lock-in is worth having. Deep integration with a good supplier delivers real value, and avoiding all dependency produces a fragmented estate that costs more to run.
The point is to know. A dependency you have priced and accepted is a business decision. One you discover during a dispute is a problem.
For each significant supplier, be able to say roughly what leaving would cost and how long it would take. That is the whole discipline, and it takes an afternoon a year.
Our consultancy team audits supplier exposure for UK businesses and writes exit terms into new agreements. Start a conversation.
