Vibe-to-Production · Portability

How Locked In Are You? Run the Exit Test Before You Need It

The platform got you here, and mostly it's been good. But something has started the clock in your head — a pricing change, an acquisition rumour, a limit you keep hitting, or an investor asking "what happens if they shut down?" You don't necessarily want to leave. You want to know what leaving would cost, so the staying is a choice.

Get your app assessed ↗See the framework
72 hours
01 / TO FINDINGS
2–6 weeks
02 / TYPICAL FIX WINDOW
500+
03 / ENGINEERS
92%
04 / ON-TIME DELIVERY
PortabilityProblem guide

How trapped you are on a platform is not a feeling — it's a measurable list: the parts of your app that only exist inside the platform's walls are exactly the parts an exit would have to rebuild. You can draw up that list tonight by attempting the exports yourself, and knowing the number is valuable even if you never leave, because unpriced exits shape decisions silently.

How to recognise it

The signs show up before the incident does.

None of these proves you have the problem. Each one raises the odds — and every one of them is checkable in the twenty-minute protocol below.

  • You've never actually tried the exportYou believe your data and code can leave because the platform says so — but nobody has ever run the export and opened the result. Beliefs about exits are worth exactly what they've been tested for.
  • Core functions have no address outside the platformLogin, the database, file storage, scheduled tasks — asked where each actually runs, every answer is "inside the platform". Each such answer is a component an exit must rebuild from scratch.
  • Pricing changes land on you, not with youWhen the platform reprices or repackages, you adjust your budget rather than your options — because there are no options. Negotiating power is exactly proportional to your ability to leave.
  • The roadmap bends around the platformFeatures get shaped by what the platform makes easy rather than what customers asked for. The walls have started doing your product design.
  • Diligence questions about it make you vagueWhen an investor or acquirer asks about platform dependency, the answer goes soft. Sophisticated buyers read unpriced exits as unmanaged risk — because that is what they are.
Why this happens

One missing layer explains every symptom above.

The platform isn't what traps you — the parts of your app that exist only inside it are.

Every convenience you adopted — managed login, built-in database, integrated storage, one-click jobs — was also a component built in a form that runs nowhere else. None of that was a mistake; it's why you shipped fast. But until those parts are counted, the exit has no price — and a move you can't price is a move you can't make, which quietly converts every platform decision into one you must simply absorb.

This is not a defect of any one tool — it follows from how prompt-built apps come to exist, and the platform guides show how the same gap surfaces on each stack.

What is actually at stake

It isn't a bug count. It's an open door.

Lock-in charges rent even if you never leave. It surfaces as pricing changes you absorb rather than negotiate, a roadmap bent around the platform's shape, and a dependency line in every diligence conversation — acquirers and investors price unquantified platform risk into their offers, whether or not you ever intended to move. The asymmetry is what makes this page cheap insurance: measuring the exit costs an evening; needing the exit unmeasured, on a deadline someone else set, costs whatever it costs.

If something has already gone wrong, the first-response guide covers the first hour. If nothing has — that is exactly the moment this is cheap to fix.

Check it yourself

Run the audit yourself — tonight.

No developer, no tooling, no permission needed — this is your own app. Work through the sheet in order; if a check fails, do it once more before believing it. What you find is yours to act on, with us or without us.

Diagnostic protocolAbout 20 minutesTwo browser windowsNo code required

  1. Export your data — then actually open the file

    Run it

    Find the platform's export function and run it for real. Open what comes out and inventory it against what your app holds: every table, user accounts, uploaded files, configuration. Check the format too — standard formats any tool can read, or something bespoke?

    What the result means

    A complete export in standard formats is a pass — data is usually the most portable layer. Gaps are the finding: whatever the export omits — files, user records, configuration — is data that today exists only inside the platform, and you've just discovered that on a quiet evening instead of during a migration.

  2. Export your code — and check it's really yours

    Run it

    Download the source code or connect the code export the platform offers. Open the first few files — you're not reading code, just answering two questions: is this the real, complete source, and does it visibly lean on things with the platform's name on them?

    What the result means

    Complete source using ordinary open technologies is a pass. Code laced with platform-specific services isn't a failure — it's the measurement: each platform-tied piece is one item on the exit's rebuild list. No code export at all puts you at the far end of the lock-in scale, and that's worth knowing tonight.

  3. List what would simply stop existing if you left

    Run it

    Walk the app's functions — login, database, file storage, scheduled jobs, forms, emails, payments — and for each ask one question: where does this actually run? Write two columns: "portable" and "exists only inside the platform".

    What the result means

    The second column is your lock-in, itemised. Short list = an exit is mostly moving. Long list = an exit is mostly rebuilding. Either way you now hold the document that turns "how trapped are we?" from a mood into a work estimate — most founders have never written it.

  4. Would your users survive the move?

    Run it

    Two ownership checks: first, confirm who controls your domain name — registered in your own account, or provided by the platform? Second, ask (support, docs, or your AI tool) whether user accounts including password credentials can be exported from the platform's login system.

    What the result means

    Own domain plus exportable accounts is a pass. A platform-owned address means your identity moves when the platform says so. And if password credentials can't leave the managed login system — often they can't, by design — a migration means every user resets their password: survivable, but a real cost that belongs in the exit price, not discovered during one.

  5. Put a number on the exit — tonight, roughly

    Run it

    Take your "exists only inside the platform" list from the third check and ask any engineer you know — or an AI assistant — to rough-estimate rebuilding each item on ordinary infrastructure. Sum it. Precision is not the point.

    What the result means

    Any defensible number is a pass, because the alternative isn't a better number — it's no number. An exit estimated even roughly is a strategic option you hold; an exit never estimated is a fear that silently shapes pricing responses, roadmap choices and diligence answers. The rough number is what turns the platform relationship back into a decision.

Each of these maps to a scored item in the production-readiness framework. A pass on all of them rules out the loudest failure class — the full audit covers what a browser can't reach, at a fixed price.

How it gets fixed

Sealed from the data layer up.

The order matters more than the effort: enforcement first, credentials second, proof third. Done in the wrong order, the work gets done twice while the exposure stays open. The same discipline runs through everything we deliver.

Get my scorecard
  1. 01

    Map the dependency completely

    Engineers produce the definitive version of your two-column list — every platform-only component, its role, and what rebuilding it on open infrastructure involves — priced and ranked. That map, the real answer to "how trapped are we?", arrives within 72 hours.

  2. 02

    Secure the assets that must never be hostage

    Automated, scheduled exports of data and code to storage you control, and the domain confirmed in your own hands. Whatever happens later, the irreplaceable things now exist outside the walls — this step alone defuses the shutdown scenario.

  3. 03

    Draw a seam through the app

    Platform-specific services get isolated behind thin interfaces of your own, so the rest of the codebase stops knowing which platform it runs on. This is the highest-leverage engineering in the whole sequence: it makes every future step smaller, whether or not you ever take it.

  4. 04

    Move only what earns its move

    Components migrate to portable infrastructure selectively — where cost, limits or risk justify it — while the platform keeps doing what it does well. Portability is a dial, not a door; full migration is rarely the rational setting.

  5. 05

    Keep the exit rehearsed

    The exports run on schedule, the dependency map stays current as features ship, and the exit estimate gets refreshed when the platform's pricing or terms shift. An exit you could execute is negotiating leverage you hold every single month — without ever using it.

Where it sits in the framework

The framework's heaviest weights sit exactly here.

25 / 100

points of the production-readiness score sit in the categories this problem touches.

See every check and weight
0The full 100-point framework100
  • 10 ptsData protection & recoveryBackups that have never been restored are not backups. This category is mostly about proving the recovery path exists.
  • 15 ptsDeployment & operationsThis is the category prototypes skip entirely, and the one that decides whether a bad release costs you ten minutes or a weekend.
Our honest read
Never leaving may well be the right call — but make it a call: run the exports tonight, write the two-column list, put a rough number on the exit, and from then on every platform decision is negotiation from a priced position instead of dependence from an unpriced one.
FAQ

The questions that follow.

QIs building on one of these platforms a mistake, then?
No — and this page shouldn't be read as regret. The platform is very likely why your product exists at all: the conveniences that create lock-in are the same ones that let you ship in weeks. The mistake isn't adopting a platform; it's carrying an unmeasured dependency into a stage of the business where real money, real customers and real diligence questions rest on it. Measure it, secure the exports, cut the seam — and the platform goes back to being a choice you're making rather than a fact you're subject to.
QWhat actually happens to my app if the platform shuts down or gets acquired?
It depends almost entirely on preparation done beforehand, which is the honest answer nobody enjoys. With current exports of data and code in storage you control, a shutdown becomes a rebuild-under-pressure of the platform-only components on your list — painful, bounded, survivable. Without them, you're reconstructing from whatever the wind-down window lets you retrieve, on a deadline someone else set. Acquisitions are gentler but rhyme: terms and pricing change, and your options are exactly as good as your prepared exit. The second fix step exists for precisely this scenario.
QShould I migrate off the platform now, while it's calm?
Probably not fully, and be wary of anyone who reflexively says yes — full migration is expensive, risky, and forfeits genuine platform strengths in exchange for problems you'd then own yourself. The rational sequence is cheaper: secure the exports, isolate the platform-specific parts behind seams, then move individual components only when cost, limits or risk make each move worth it on its own terms. Many apps that run this sequence never migrate anything — they just stop being trapped, which was the actual goal.
QThe platform advertises that there's no lock-in and code export is built in. Can I relax?
It's a genuinely good sign — platforms that provide full code export are being straight with you, and it puts you at the fortunate end of the scale. But treat it as a claim to verify rather than a setting to trust: run the export, open it, and check what the code does about the services around it — login, database, storage, jobs. Exported code that still calls platform-hosted services for its vital functions is portable in form but tethered in fact. The two-column list, run against the actual export, is what tells you which you hold.
QHow does lock-in affect an acquisition or a fundraise?
Technical diligence almost always asks the question, and what's being evaluated is less the dependency than your command of it. "Everything runs on one platform" answered with a current dependency map, scheduled exports, and a priced exit plan reads as a managed vendor relationship — unremarkable, like any supplier. The same fact answered with vagueness reads as risk, and risk gets priced into offers. The preparation this page describes is nearly free compared to what an unpriced dependency costs you in that room.
QWhat does the dependency assessment cost, and what do I get?
It's the same fixed-price audit ($2K – $5K), findings within 72 hours: the complete dependency map, verification of what your exports actually contain, the password-and-domain ownership check, and a priced, ranked exit plan you hold whether or not you ever use it. If you choose to cut the seams or move components, that's scoped separately — typically 2–6 weeks — and the report is written so any competent team could execute it, including one that is not us.
Where to go next
Other problems
Before you share anything
Your IP · 100% yours, in writing

Nobody has ever regretted sending us their repository.

Handing private code to anyone is a real decision, so everything below is settled before the audit starts rather than on request.

  1. An NDA is signed and returned before you send a linkStep one, every time
  2. Access is read-only, scoped to one repository, and time-boxedRevoked on delivery
  3. Our copy of your code is deleted when the report landsNothing retained
  4. We build for clients and never launch anything that competes with themNever has happened
No-obligation diagnosis

Send us the repository. We'll tell you what's missing.

Fixed price, 72 hours to findings, and a report you can act on with or without us. Nothing is committed until you have read it.

NDA signed before you send anything · read-only access, revoked when the report lands · our copy deleted on delivery.

4.8/5Clutch4.9/5GoodFirms