When your cloud storage vendor goes out of business, the exit clause goes with it

Every backup guide tells you to keep a copy somewhere else. Almost none ask who that somewhere else answers to. A public television station in St. Louis has spent five months finding out, and the useful part is not that it was careless. It did what a careful organisation is supposed to do, including negotiating a written way out, and it is still in a Denver courtroom asking a judge for its own archive.

Fifty terabytes of St. Louis, in a building nobody disputes

Nine PBS had bought storage since 2019 from a predecessor of the firm that became Open Source Storage, renewing year by year. The latest agreement was set to expire on March 6, 2026, and it included a 30-day window to retrieve the data after termination. The station tried to arrange a renewal meeting in February and got no answer. On March 6 access was cut off, with no notice and no 30 days. The vendor's website was gone and the company was carrying delinquency status with the Colorado Secretary of State.

The data did not move. More than 50 terabytes covering over 70 years of programming, including its coverage of the 1993 flood and the pandemic, sits in an Iron Mountain data centre in Denver, where it sat all along. But Iron Mountain's customer was OSS, and the equipment holding the files belonged to OSS. When the station asked for its own archive, Iron Mountain declined: its contractual commitments ran to OSS, and it does not itself have access to the data.

Nine PBS sued OSS and its stated president in St. Louis in April, paused when someone from the group that had acquired OSS's assets confirmed the archive was safe, and moved again when that person stopped replying. On July 28 it sued Iron Mountain in Denver District Court. In August, Judge Eric Elliff found the station is the rightful owner, ordered Iron Mountain to cooperate, and gave Nine PBS 30 days to find a third party, possibly a former OSS employee, able to get the data off without harming other customers' data. Both sides report back on September 14, and if the data turns out to be encrypted there will be another hearing.

Worth being precise where the headlines are not: this is a lockout, not a deletion. The files are believed intact and a court has ordered a process. Whether it ends well is not known yet.

An exit clause is a promise, not a capability

The 30-day retrieval window is the part worth staring at. It was in the contract, it is exactly the clause a diligent person checks for, and negotiating it was right. It failed for a reason unrelated to how it was drafted. A clause describes something a company does, and a company that has stopped existing does not do things.

That separates two properties which look identical while everything is working. One is whether you can get your files out. The other is whether somebody would hand them to you if you asked. The second is a promise, downstream of the promiser's solvency, attention and continued existence. The first is a capability, and it can be tested. On an ordinary Tuesday both just look like access.

So the test is not whether an exit path exists on paper. It is whether you have used it. A copy you have already pulled down and opened is a capability. An export button you have never pressed is a promise, and so is a sync client that only ever runs one way.

The custodian you never chose

The other half of this has no common name, which is usually a sign it is under-discussed. Nine PBS chose OSS. It did not choose Iron Mountain, and before March had little reason to think about it. The chain ran from the owner to a vendor to the vendor's vendor, and it broke at the link the owner did not know was there.

Iron Mountain is not the villain of this. Its position, that it will not hand the contents of one customer's equipment to a company it has no agreement with, is defensible, and it is the same principle any reader would want applied to their own data if a stranger turned up claiming a share of the rack. The safeguard and the lockout are one mechanism seen from two sides. Which is why "choose a reputable vendor" does not answer it: every company here behaved defensibly, and the archive still went dark for five months.

The household version of the exercise is short. For each copy of your files, name the company you pay. Then name who they depend on. Then say what happens to your access if the first one stops answering email. Most people can do the first, fewer the second, and the third is what decides how expensive somebody else's bad year gets. If a copy depends on nobody, write "nobody" and move on. That answer is the point rather than a trick.

The honest tradeoffs

None of this is an argument that the cloud is a bad place to keep files. A large provider's business risk is lower than a small one's, and a drive in your house has failure modes a data centre does not: dropped, stolen, burned, or quietly accumulating bad sectors while nobody watches. What happened here was one small vendor ceasing to exist, not the concept of paying somebody to hold your data. Keep the clouds you like. And a 50TB broadcast archive is not a household problem; the transferable part is the question, not the hardware.

What a copy at home changes is narrow enough to state plainly: it takes a link out of the chain. A drive plugged into a dock in your own house is a copy whose availability does not depend on anyone's solvency, and what is on it is ordinary files on an ordinary filesystem, so the retrieval plan reads "plug the drive into a computer" rather than "find somebody who used to work there." Harbor Dock has a company behind it, and companies can stop existing. The commitment that answers this story is that the dock's operating system is open source at launch, so Harbor going away does not take the files with it.

That is a smaller claim than a court case invites. The bigger one belongs to the exercise: for every copy you keep, know who holds it, know who they hold it with, and have opened at least one of those copies recently enough to be sure you still can.