A record system you can't leave is a record system you can't trust — so the exit is built as carefully as the vault.
Export is never paywalled. Free plan, lapsed plan, angry-at-us plan: one click downloads everything. Originals are byte-identical. Every document comes back exactly as uploaded — SHA-256 fingerprints in the manifest prove it. Raw payloads included. When claims arrive from your insurer or Medicare, the verbatim payer data rides along, so your evidence never depends on our interpretation. Deletion is deletion. Close your account and the encrypted blobs and rows go with it.
A letter arrives asking you to substantiate HSA distributions. You: 1) sign in, 2) press Export → Audit packet, 3) print. The packet opens with the statutory basis, then walks year by year: each expense paired with its insurer adjudication (Level 1) and the bank record that paid it (Level 2), your return status and 1099-SA reconciliation (Level 3), family attribution, the Schedule A exclusion list, and a tamper-evidence statement — the event log is hash-chained, and the packet verifies the chain in front of the reader. Want belt and suspenders? Export → Everything (.zip) adds every original file and a fingerprint manifest. Hand either to your CPA and go back to your day.
Documents encrypted at rest (AES-256-GCM), scrypt-hashed passwords, optional two-factor authentication, strict browser protections, and per-account isolation tested from an attacker's seat. If you link an advisor they see summaries, never documents — revocable in one click. Security and portability aren't in tension; they're the same promise from two sides.
Free plan includes every export, forever. Not tax advice.