My resilience insurance

1. An insurance, in the sense of a precaution

The word "insurance" is a figure of speech. It is not an insurance contract, nor a guarantee of results, and no compensation is provided. It is a set of concrete provisions that you can check yourself:

• your data stays yours, and several applications export it in a ZIP archive that can be read without our tools (CSV, JSON, Markdown);
• for most of these applications, a desktop counterpart works offline on Windows, Linux and Android, with the data on the device;
• exit-support tools (Migration, DataVirt, Contracts) help you leave a current system without breaking operations;
• registers and assessments (Process, Architecture and processes, Policies) keep the documentation that an exit strategy calls for.

2. What DORA asks for, and where we help

Regulation (EU) 2022/2554, known as DORA, aims at the digital operational resilience of financial entities. Among its requirements, four bear directly on the subject of this page:

• Article 28, paragraph 8: for ICT services supporting critical or important functions, the financial entity puts exit strategies in place, which are comprehensive, documented, sufficiently tested and periodically reviewed;
• Article 30, paragraph 3, point (f): the contract with the provider provides for these exit strategies, in particular a mandatory adequate transition period;
• Article 12: documented backup policies and restoration procedures, whose procedures are tested periodically;
• Article 11: an ICT business continuity policy, with its response and recovery plans.

Prophetix helps you prepare these points. We certify nothing: assessing your situation, choosing your critical functions and deciding on compliance remain yours, together with your legal adviser and your supervisory authority. The reference requirements supplied in Policies are reworded examples, few in number, with no claim to completeness.

This works in both directions. Your own ICT providers are subject to your exit requirements; Prophetix is one of them if you entrust us with services that matter. We would rather give you the means to leave us than ask you to take our word for it.

3. Leaving your current systems easily

An exit strategy is only worth something if a fallback exists and the switchover has been rehearsed. Here is what helps.

Migration: moving in waves

• Migration copies email from an IMAP server, Microsoft 365 or Google Workspace to an IMAP server or Microsoft 365, in waves that you start, pause and resume; a synchronisation of the latest changes precedes the cutover.
• It reads Active Directory, LDAP, Entra ID or a CSV or LDIF file, and matches the identities of the source and the target.
• It synchronises file shares (local folder, Windows share, WebDAV) with their Windows access rights, after a preview of what would be done.
• What it does not do yet: migrate calendars and contacts, write to the target directory, use Google Workspace as a destination. It is in preparation and has not yet been proven on real mailboxes or real directories.

Odoo: taking your data over into Business

• Business can receive quotes, orders, invoices and accounting from Odoo 17, 18 or 19, with totals reconciled against those of Odoo; automated rules arrive deactivated, to be reviewed.
• This takeover has been tried on a test bench, not on your data: plan a rehearsal before relying on it.

DataVirt: rehearsing without touching production

• DataVirt creates a virtual database on top of your production in a few seconds, with personal data masked. Everything you write there stays in the virtual database.
• Impact analysis replays your queries before and after a change: broken queries, changed results, lost indexes, and everything that depends on a removed column.
• You can thus try a migration or a switchover end to end, several times, with no risk to operations.

Contracts: knowing when to leave and at what price

• Contracts keeps the register of your contracts: dates, tacit or express renewal, notice periods, calculated deadlines, earliest end and the firm commitment that remains.
• It flags a third party as a critical provider when an important activity depends on it, and produces a schedule to import into your calendar.

4. Not locking yourself in with us, either

The exit applies to Prophetix too. That is the purpose of the desktop counterpart and of the export.

• Export readable without our tools: Business (for its brands), Contracts, CRM (campaigns included), Payroll, Policies and HR (for its expense reports) export the organisation as a ZIP archive (registers in CSV, objects in JSON, texts in Markdown, original attachments). Connect exports its conversations the same way, and SOC exports its events as CSV or NDJSON and its configuration as JSON.
• Verified import: Contracts and Policies check the archive on import, with checksums verified, and apply everything in a single transaction.
• Offline counterpart: Business (for its brands), Contracts, CRM, Payroll and HR (for its expense reports) work on Windows, Linux and Android, without a server, with the data on the device; Policies works on Windows and Linux, and can be read on Android.
• The architecture model of Architecture and processes fits in one file, with its document folder, on a Windows computer, without a server.

This list does not cover the whole catalogue. Other applications, such as CMDB, Business, Family or Polls, have no organisation export at this time. Before building an exit strategy on an application, check on its page that it exports, and what it exports.

Two points remain to be settled and we would rather tell you: how long a desktop counterpart works without reaching the server, and what becomes of the export once the subscription has ended. Meanwhile, export before you cancel, not after, and do not count on offline work with no time limit.

5. A continuity plan that is easy, and demonstrable

A plan that has never been played through is only an intention. Here is an exercise you run yourself, with steps that work today in the applications named above:

• export an application's organisation as a ZIP archive, and note the date and the application;
• open the archive with a simple spreadsheet and a text editor: if you can read your data, you do not need us to read it;
• cut the network on a computer and open the desktop counterpart: the register remains readable and editable;
• import the archive into an empty organisation and compare: in Contracts and Policies, the import checks the checksums of the files;
• record the result: in Architecture and processes, a supplier assessment includes a "tested continuity plan" field; in Contracts, you flag the supplier as a critical provider; Process keeps the DORA registers (ICT providers, incidents, risks), with an audit trail whose every entry carries a SHA-256 fingerprint.

The products do not generate an exercise report: the minutes are yours, and they are what you will show. What Prophetix brings is that the exercise is short, that it works with readable files, and that it leaves a trace you can keep.

For the monitoring and inventory around this plan, CMDB keeps the inventory of IT assets, SOC centralises logs and raises alerts, and Security audit reviews the directory, computers, network and applications.

6. What this page does not say

• This is not a guarantee, nor an insurance contract, nor legal advice. No Prophetix application certifies compliance with DORA or any other text.
• Process's DORA register of information exports as XML in a format specific to Process, not in the official filing format, which is in preparation.
• Several applications are still in preparation. The state of each, its platforms and its limits are on its page: read it before relying on it.
• Backup, the computer backup application, does not yet run backups: we do not count it in this plan.
• None of the above replaces a test on your own data.

7. Getting started

• Pick a function that matters to you, and the application that carries it.
• Play the exercise from the previous section, on test data.
• Record the result, then do it again whenever you change tool or provider.