Home / Switching provider and data export

Switching provider and data export

You can switch to another provider or to your own system at any time. Switching is free of charge and you receive the data of your company in open, machine-readable formats, with the exceptions named below.

This English version is provided for convenience. In case of doubt, the German version shall prevail.

Process in four steps

Request – The administrator of your company files the request in the portal under “Administration → Switching”, confirmed by signing in again. You see all dates at once. The first full export is created right away.
Transition period – After a notice period of at most 60 days the transition period of 30 days starts. During this time Complass keeps running unchanged and you can withdraw the request.
End of contract and second export – The contract ends with the successful switch and nothing is billed afterwards. We create the second full export with the latest state. Your access is then read-only.
Retrieval and erasure – For 30 days after the transition period you can still retrieve your data; you can extend this retrieval phase once by 30 days, and we remind you 14 days before it ends. After that all data is erased automatically, also with “export and erasure”; you receive the erasure confirmation as a PDF.

Charges

We charge nothing for switching and for the export.

What you receive

The full export is a ZIP archive with this structure:

01_Projekte – Per project the compliance package with decrypted evidence files, Excel, CSV and JSON (also projects in the recycle bin)
02_Maßnahmenplan – All tasks as Excel and JSON
03_Vorfälle – All incidents with reporting status as Excel and JSON
04_Assets – Assets, software and relations as Excel, CSV and JSON
05_Schwachstellen – Vulnerability findings as Excel, CSV and JSON
06_Kundenprotokoll – The log of your company as Excel and CSV
07_Nachweise – Evidence files without a project, decrypted
08_Rohdaten – The tables of your company as JSON, one file per table, field names as in the database (exceptions below)
09_Sicherheitsprotokoll – Security events of your company

The raw data currently cover 450 tables. Field names and their meaning are described in the developer documentation (exchange format).

Formats

JSON – Raw data, action plan, incidents, assets, vulnerabilities
CSV / Excel (XLSX) – Lists and logs
CycloneDX 1.6 – Software bill of materials (SBOM)
SPDX 2.3 / 3.0.1 – Software bill of materials (SBOM)
CSAF 2.0 VEX – Statements on the exploitability of vulnerabilities

What is not exported

Passwords, authenticator secrets, recovery keys and single-use links are not exported.
Internal fields of Complass (log chain values, internal ticket notes) are not exported.
Whistleblower cases and their metadata are not part of the full export (protection of whistleblowers).
Billing data between Complass and you (payment events, coupons, accounting links) is not included; you receive invoices as PDFs.
Order and consent records are contract evidence of Complass (statutory retention); the person receives them on request under the GDPR.
Data of other companies is not included; of supply-chain partnerships we export your side without invitation links.
Evidence files are decrypted in the archive.

Location of the infrastructure

Hosted by Hetzner Online GmbH on servers in Germany. An encrypted copy of every backup is kept outside the server in a data centre in Germany. More on security and data protection

Contact

We answer questions about switching at info@complass.eu.

Legal basis: Regulation (EU) 2023/2854 (Data Act), Chapter VI. General information, not legal advice.