Exit documentation

Getting your data out of Olto.

What comes out, in what format, how long it takes, what happens to a published Passport, how deletion works, and what you cannot take with you. Self-serve, no ticket, no fee, no notice period. Written down because it is the question you should ask before you put a year of work somewhere.

The one-file version

One button produces one file with everything in it.

Settings, then Privacy, then the button marked Export my data. There is no request form, no support ticket, no export fee, and no plan that withholds it, including the free one. There is also no queue and no overnight job: the export is one request that returns the file, so how long it takes is how long your browser takes to save it.

Tables read
65

Plus your full profile row.

Format
JSON

Indented, one file, named for the date you ran it.

Runs allowed
5/hr

Per account. It reads a lot of tables at once.

Session freshness
10 min

An older session is asked for your password again first, then the download retries.

The file starts with a manifest

Before any data, the export writes a list of every table it included and how many rows it found in each. That is deliberate: a count of zero is visible, and a table that is missing from the list is missing on purpose rather than by accident. You can check the export against this page without opening a single record.

It is an archive, not a restore

The file says so itself. Every export carries this note, and we quote it here rather than paraphrasing it:

This file is human-readable and machine-parseable; there is no automated re-import path today, so treat it as an archive/backup rather than a one-click restore.

Every table it reads, named

Grouped for reading. The names are the real table names, so you can match them against the manifest in your own file. Measured August 2026.

Protocols and their history

8
protocolsprotocol_stepsprotocol_versionsprotocol_refinementsprotocol_risk_scoresprotocol_complianceprotocol_starsprotocol_templates

Runs, findings and evidence

5
findingsfinding_linksevidenceprotocol_test_runssimulation_runs

Lab notebook

6
notebooksnotebook_entriesnotebook_entry_versionsnotebook_entry_signaturesnotebook_entry_refsnotebook_collections

Inventory and reagents

3
inventory_itemsinventory_transactionsreagents

Projects and literature

5
projectsproject_memberspaperspaper_collectionspaper_collection_items

Analysis

6
image_analysesstat_analysesanalysis_templatessaved_recipessaved_sample_size_calcscustom_tools

Assistant conversations

2
conversationsmessages

Standards

2
standards_finder_resultsstandards_bookmarks

Files, comments, calendar and support

4
commentscalendar_eventsfilessupport_tickets

Teams, follows and notifications

5
organizationsorganization_membersuser_followsnotificationslims_notifications

LIMS records you own or authored

5
lims_orderslims_invoiceslims_messageslims_providerslims_provider_members

Bounties

2
bountiesbounty_submissions

Engineering records

2
eng_recordseng_verifications

Education workspace

8
education_schoolseducation_school_memberseducation_class_memberseducation_assignmentseducation_rubricseducation_project_memberseducation_educator_profileseducation_ai_runs

Your own security history

2
login_historyaudit_log
Per record, per format

What each kind of data comes out as.

The account export is the whole account at once. Counting it, 32 endpoints hand the browser a file, between them covering 10 distinct formats: CSV, FHIR R4 JSON, HL7 v2.5.1, HTML, ICS, JSON, Markdown, PDF, Plain text, X12 837P. This table says which of them applies to what, and names the one place where the answer is that nothing does.

Protocols

PDFHTMLMarkdownJSONPlain text

One protocol at a time through the export route, in whichever of the five formats you ask for. Markdown is the one to take if you intend to keep editing it somewhere else. The account export carries every protocol at once as JSON, including the step graph and the version history.

protocolsprotocol_stepsprotocol_versions

Test runs

PDF

The session report is a PDF: steps, timings, notes, pass and fail and deviation. The underlying run rows, including the per-step record, come out as JSON in the account export.

protocol_test_runssimulation_runs

Findings and evidence

JSON, in the account export

JSON rows in the account export. Evidence rows carry the link to the uploaded file rather than the file itself, so the attachment is fetched separately.

findingsfinding_linksevidence

Notebook entries

PDF

A PDF per entry, with the signature footer. The account export carries the entry blocks as JSON, which is the editable form, plus every prior version and every signature.

notebook_entriesnotebook_entry_versionsnotebook_entry_signatures

Datasets

No download

Nothing today. Saved plate and tabular datasets have no download route, and the account export does not read the table they live in. This is a gap, not a policy.

LIMS records

CSVPDFHL7 v2.5.1FHIR R4 JSONX12 837P

The widest set of formats in the product, because a lab record has to arrive somewhere that is not Olto. Results as CSV, certificates and invoices as PDF, and the same results as an HL7 v2.5.1 result message, a FHIR R4 bundle, or an X12 837P claim. Every builder is deterministic, so the same order yields byte-identical output each time.

lims_orderslims_invoiceslims_messages

Uploaded files

JSON, in the account export

The original bytes, unchanged, one file at a time through a short-lived signed link. There is no bulk archive. The account export carries the file records, meaning the name, the type, the size and the storage path, not the contents.

files

Assistant conversations

PDFMarkdown

PDF or Markdown per conversation, including each assistant turn’s tool activity: what it searched, what it read, and which of your own records it cited.

conversationsmessages

Engineering and metrology records

PDF

One PDF per instrument, each printing the inputs alongside the result so the number can be re-derived by hand. The sealed verification record carries its SHA-256, which you can recompute from the same content without us.

eng_recordseng_verifications

Verity reports

PDFJSON

PDF or JSON per completed report. The JSON is the full stored report, including the engine version and the engine fingerprint the result was produced under. These reports are not part of the account export.

Team audit log

CSVPDF

CSV or PDF for a team you administer. Your own login history and your own audit rows are in the account export as well, because the export is meant to be everything held about you rather than everything convenient to hand over.

audit_loglogin_history

Billing and usage

PDFCSV

CSV or PDF. Invoices themselves live with the payment processor and are reached from the billing portal.

Class records

CSVICS

Class progress as a gradebook-pasteable CSV, and the class calendar as ICS. A teacher only ever exports a class they manage.

education_assignmentseducation_rubricseducation_class_members

Separately, 40+ analysis and lab screens build a CSV in the page and hand it straight to the browser. Those never reach a server, so there is no request to rate-limit and nothing to ask permission for.

The permanent URL

What happens to a published Passport when you go.

A Passport is a public, citable URL. That is the point of it, and it is also the part of leaving that people are right to ask about, because a citation someone else has printed is not yours to take back. Here is exactly what breaks, what persists, and what was never in our gift.

You unpublish the protocol

The Passport URL returns 404 from that moment. The page, the JSON manifest and the PDF all read the protocol through the same public flag, so all three stop serving together. The page also tells search engines not to index the missing record. The sitemap regenerates hourly and lists only public, active protocols, so the URL drops out of the next build.

You delete the account

The protocol row is removed by a cascade from your authentication record. The Passport returns 404 for the same reason as above, and there is no state in which it comes back. Republishing later means a new protocol and a new URL.

What stays public either way

Every copy someone else already took. A downloaded Passport PDF, a saved JSON manifest, an embedded badge image cached by whoever embedded it, and any third-party search index that crawled the page. None of those are ours to withdraw, and we will not claim otherwise.

Forks stay with the person who forked them

A fork is a separate protocol owned by the scientist who made it, not a view of yours. When your row goes, their copy survives and its pointer back to your protocol is set to null. You cannot withdraw a fork, and unpublishing does not retract one.

The permalink is an Olto URL, not a DOI

DOI minting is built but dormant: it is gated on registration-agency credentials that are not configured, so no Passport carries a registered DOI and none is claimed to. A Passport URL therefore depends on this domain continuing to resolve. If you need an identifier that does not, take the Fingerprint and the Capsule instead.

The two identifiers that survive us

The Reproducibility Fingerprint is content-addressed: anyone holding the protocol text can re-derive the same id with no account and no server. The Capsule encodes the whole protocol as one string that decodes offline and recomputes its own fingerprint, so a corrupted or altered copy is detectable by the person holding it. Both work if Olto is gone.

The Fingerprint is specified in public at the Fingerprint spec, and you can watch it run on your own text at the Fingerprint page. Neither needs an account, and neither needs us.

Deletion

How the delete works, in the order it happens.

Settings, then Security, then the danger zone. You type the word DELETE. If you have multi-factor authentication enabled you must already be at your second factor to reach the operation at all. Export first: there is no undo, and support cannot reverse it for you.

  1. Three checks run first, and can stop it

    Deletion is refused, with the reason, if you own a team that still has other members, if you run a lab in the LIMS that still has orders against it, or if you have a bounty with funds in escrow. Nothing has been changed at that point. Transfer or resolve the blocker and run it again.

  2. References to you on records that survive are cleared

    Rows other people keep stop pointing at you: the invited-by on a team membership, the added-by on a project membership, the approver on a protocol, the resolver on a comment. Invitations you sent or received are deleted outright.

  3. A team or lab you own alone is removed

    Having passed the checks, an organization you created with no other members is deleted, along with its memberships, invitations, calendar and projects. So is a LIMS provider you own that has no orders.

  4. Any active subscription is cancelled

    Cancellation is issued to the payment processor before the account goes, so a deleted account is not billed again.

  5. The authentication record is deleted, and your rows cascade with it

    This is the irreversible step. Deleting the auth user removes your rows across the schema by foreign-key cascade and clears every session, identity and multi-factor enrolment.

  6. Uploads and your avatar are removed from storage

    Storage objects carry no foreign key, so they are deleted explicitly: your files in the research bucket, and your avatar in the public one, which would otherwise survive at its public URL.

One record is written, not removed

A single audit entry records that an account was deleted. It is written with no user id, because the user no longer exists, and carries the former account identifier in its metadata. It exists so a deletion cannot be performed and then denied, which is the same reason the rest of the audit trail exists. It is the only row the deletion writes rather than removes.

Afterwards

What is retained, and for how long.

This is the part most exit pages get vague about, so read the specific claim rather than the tone of it. One retention period is committed to as a number. The rest are not, and we are not going to invent figures here that the privacy notice does not carry.

Committed as a number

Billing records: at least seven years

Kept to meet tax obligations. This is the only retention period the privacy notice states as a figure, and it is a legal floor rather than a preference.

Stated without a number

Account data, content, logs and backups

Account information is held for a period after deletion to allow recovery and meet legal obligations. Content is removed from active systems within a reasonable period. Encrypted backups persist until the rotation overwrites them. Security and audit logs are held for a bounded period that depends on the event. None of those four periods is published as a number, so do not plan around one.

Not ours to time

Anything already sent to the model provider

Olto is not end-to-end encrypted. Prompts, files submitted for AI processing and assistant conversations reach our inference provider to produce a response, and their retention is governed by their API terms rather than by ours. Deleting your Olto account does not reach into their systems. That content is not used to train Olto-owned or public models.

If you would rather ask

A rights request gets a reply in 30 days

Access, correction, deletion, portability, restriction and objection can all be exercised by email, with a response within 30 days where applicable law requires one. The self-serve export and delete above cover portability and erasure without waiting for us.

The authoritative wording for all of this is the privacy notice. Where this page and that page disagree, that page governs and this one is the bug.

The limits

What you cannot take with you.

An exit page that lists only what works is an advertisement. These are the places where the answer is no, or not yet, as of the same measurement date as everything above.

A restore

There is no automated re-import. The export is designed to be read by you and by other software, not to be loaded back into Olto by clicking something. If you leave and return, you start a new account and bring your records back the way you would bring them into any other system.

A programmatic sync

There is no public API. You cannot schedule a nightly pull into your own store, and you cannot script the export. Everything on this page is something a person clicks. The internal developer console is not a public interface, whatever its name suggests.

Your uploaded files in one archive

Files come out one at a time, as the original bytes, through a link that is valid for 5 minutes. The account export carries the file records, meaning the name, type, size and storage path, but not the contents. A library of a few hundred attachments is a few hundred clicks.

Saved datasets, which the account export does not read

Plate and tabular measurement data saved from the data workbench, together with the well map, the analysis options and the computed result. Nothing. There is no per-record download for a saved dataset and the account export does not read this table, so the only copy that leaves Olto today is the instrument file you started from. If this matters to you, keep that file.

datasets

Verity reports, which the account export does not read

Completed Verity precision-medicine reports: the variant call, the evidence set, the therapeutic read and the target dossier. Each completed report downloads on its own as a PDF or as JSON, from the report itself. The account export does not collect them, so a report you want to keep is a report you download.

verity_variant_reportsverity_evidence_reportsverity_therapeutic_reportsverity_dossier_reports

Molecular-pathology case records, which the account export does not read

Molecular-pathology case records: the case, its workups, the locked classifications, the sign-off attestations and the evidence citations behind them. A workup downloads as a PDF from the case. The case record itself, its audit events and its attestations stay in the database.

pm_casespm_workupspm_classificationspm_attestationspm_evidence_citations

Rows that are not yours

The export filters every table on the column that ties a row to you. A protocol a teammate owns and shared with the team is theirs, not yours. A class you are enrolled in but do not manage exports for its teacher. A LIMS order exports for the requester who placed it, so orders you ran as the provider are not in your file. This is a boundary, not an oversight, but it does mean your export is smaller than what you can see on screen.

Operational metering, excluded on purpose

9 tables are deliberately left out on the grounds that they are meters rather than records you made. They are named here so the omission is a decision you can see and disagree with, rather than one you discover by noticing a gap.

ai_callsai_spendusage_eventsusage_limitsweb_vitalsserver_errorssubscription_eventsprotocol_presencepromo_redemptions

Every figure on this page is derived from the export code itself and pinned to it by a test, so adding a table, a format or a route fails the build until this page agrees with reality. If you find something here that the product contradicts, that is a defect and we want to hear about it.

Check it before you commit to it.

Generate a protocol from your own sentence, sign up, and run the export the same day. Reading an exit page is one thing. Downloading the file and opening it is the version that settles the question.

Try OltoThe rest of the trust centre