Draft, pending approval

Data export and portability

Draft 27 October 2026, not yet in force

This description applies to the production service and takes effect together with the terms of service. Draft 27 October 2026.

The Customer’s data belongs to the Customer. This page says which data can be exported, in which formats and how to request an export. It meets the requirement of Article 26 of the EU Data Act (2023/2854) to point to where data structures and formats are described. It is based on section 9 of the terms of service and section 17 of the data processing agreement. When the terms of service and the data processing agreement take effect, they take precedence.

In short

The published knowledge cards can be exported at any time during the contract, as Markdown and JSON. Export is free of charge.
After the contract ends there is an export period of at least 30 days. If you switch to another service, the service first continues for a 30-day transition period (section 12 a of the terms of service).
An administrator can download all exportable data themselves as one ZIP file (JSON) from the Organization page. Tarumo delivers the read and "helpful" counts per card as JSON on request, within 14 days.
Tarumo charges no switching or data transfer fees.

What an administrator can export in the service

Data	Format	Where
Published knowledge cards and their archived versions with sources (the expert or "Former expert", and dates), and the cards’ warnings about outdated or incorrect information without the reporter’s details	JSON and Markdown	Organization page, Data export
All data in one file: the published knowledge cards as above; key persons and their areas of expertise (departure date and its confirmation, criticality, sole expert, successor and link to a knowledge pack); the Customer’s own knowledge packs and the Customer’s changes to Tarumo’s packs, with their versions, and the pack suggestions sent by experts in Mapping; coverage by area of expertise and by sub-area; users and their roles, the accountant, teams, team challenges, reward settings and the organisation’s other settings; the organisation’s whole log, except card views and card reports	ZIP file of JSON files	Organization page, Data export, Download all data
The organisation’s log as CSV (at most the 10,000 newest events), except card views and card reports	CSV	Log page
The Mapping final report, if the Customer has had a Mapping	Markdown	Mapping page, Final report
Invoices	PDF	Invoices on the Organization page (customers who pay by invoice) or the Stripe payment portal (customers who pay by card). The accountant can download them too.

Export is also available while the service is suspended for non-payment, and after the contract ends until the end of the export period. Downloading all data needs a sign-in from the last 15 minutes and can be done at most five times an hour. Downloads made in the service are written to the organisation’s log. When invoices are downloaded from the Stripe payment portal, only the opening of the portal is logged.

What Tarumo delivers on request

On request, Tarumo delivers the following as JSON within 14 days at the latest:

card read counts and the number of "helpful" marks, as figures per card;
the content of the Download all data file described above, if an administrator cannot download it themselves, for example because the organisation no longer has an administrator who can access the service.

If a request is made during the export or retrieval period, Tarumo delivers the data even if delivery falls after the period ends, and does not delete it before delivery.

What is not exported, and why

Interview texts and recordings, unresolved card drafts and Mapping suggestion drafts. Only the interviewee can see them, and they are deleted after a short time. This is how the Customer, as controller, has instructed Tarumo, and data protection rules take precedence over the Data Act. Interviewees can download the texts of their own interviews from the Interview page for as long as they are kept.
Personal points, levels, achievements and reward choices. They are visible only to the person themselves.
Card opening rows (who opened which card) and who reported a card. They are not shown to the Customer, so that the log does not tell who read or reported what.
Filtered content, which is not stored.
Internal operation of the service: AI prompts, intermediate results of the risk calculation, the vectors of the search index and the service’s technical log. They are Tarumo’s trade secrets or tied to Tarumo’s implementation.
Tarumo’s general knowledge packs, which are Tarumo’s intellectual property. The Customer’s changes to them are exported.

File formats and structure

All files are in commonly used, machine-readable formats: JSON (UTF-8), Markdown (UTF-8), CSV (UTF-8, comma-separated) and PDF. The structure of the knowledge card JSON file is a contract and is described here. The Markdown file carries the same content for people to read, and its layout is not a contract.

The knowledge card JSON file (version 1)

File name: tarumo-<organisation id>-tietokortit-YYYY-MM-DD.json (the day of the export, Finnish time). Media type application/json; charset=utf-8.
Versioning: the schemaVersion field is an integer. Adding a field does not change the version, and a reader must ignore fields it does not know. Removing or renaming a field, or changing its meaning, raises the version, and this page is updated at the same time.

Field	Type	Meaning
`schemaVersion`	integer	The version of the structure (now 1).
`generatedAt`	string	The moment of the export, ISO 8601 (UTC).
`organization`	object	`{ name, slug }`: the organisation’s name and id.
`cardCount`	number	The number of current cards (archived versions are not counted).
`cards`	array	The current cards, sorted by area, category and title.

A card (an element of the cards array):

Field	Type	Meaning
`id`	string (uuid)	The card’s id. Stable: a later export has the same id for the same version.
`title`	string	The title the expert approved.
`items`	string array	The points of the card, in the expert’s words, in order.
`source`	object	`{ name, publishedAt }`: the expert’s name as it was when the card was approved, and the moment of approval (ISO 8601).
`topic`	object	`{ area, category }`: the area of expertise and the knowledge pack category, or `null` when the area has no pack.
`locale`	string	The language the card was written in (`fi`, `en`).
`status`	string	`published` for a current card.
`warning`	object or null	The warning every member sees on the card: `kind` (`marked` or `reported`), `reason` (`outdated` or `incorrect`), `on` (the day, YYYY-MM-DD) and `note` (in the reporter’s words, or null).
`history`	array	Earlier versions the card replaced, newest first. The fields `id`, `title`, `items`, `source`, `topic`, `locale` and `archivedAt`.

The file never contains drafts or rejected cards, reporters’ details, user ids or email addresses, read counts or "helpful" marks. It holds no personal data other than the name of the card’s source.

The all-data ZIP file (version 1)

File name: tarumo-<organisation short name>-vienti-YYYY-MM-DD.zip (the day of the export in Finnish time). Media type application/zip. An ordinary ZIP file (Deflate compression, UTF-8 names) that any unzip program can open.
Content: JSON files (UTF-8). Each has the fields schemaVersion, generatedAt and organization ({ id, name, slug }), except cards.json, which is the same as the knowledge card JSON file above. Instants are ISO 8601 (UTC) and days YYYY-MM-DD. People are referred to by an id (userId) that is the same in every file.
Versioning: as for the knowledge card file. The structure’s version is in manifest.json.

File	Content	Fields
`organization.json`	The organisation’s settings (industry, audio retention, incentives, status), the package and key person limit, the Microsoft Teams settings, the Entra ID provisioning settings, HR connectors and API keys without any secrets.	`settings { industry, audioRetentionDays, incentivesEnabled, status, eraseAfter, createdAt }`, `plan { package, keyPersonLimit, keyPersonsUsed, startsOn, endsOn, invoiceReference }` or `null`, `microsoftTeams { enabled, allowedTenantIds }`, `entraProvisioning { entraTenantId, tenantConfirmed, defaultRole, groupRoles }`, `hrConnectors[] { id, kind, name, enabled, settings, hasCredentials, lastSyncAt, lastStatus }`, `integrationTokens[] { id, kind, name, scopes, createdBy, createdAt, expiresAt, lastUsedAt, revokedAt }`
`users.json`	Members with their roles and the days they joined and were removed (a removed member’s name and address are no longer shown), open invitations and the accountant.	`members[] { userId, name, email, role, status, joinedAt, removedAt }`, `invitations[] { id, email, role, expiresAt, expired }`, `accountants[] { userId, name, email, status, since, removedAt, removedReason }`
`key-persons.json`	Key persons (archived ones too), their departure details (type, day, confirmation and successor) and their areas of expertise (criticality, sole expert and the linked knowledge pack).	`keyPersons[] { id, displayName, jobTitle, startYear, userId, teamId, createdAt, archivedAt, departure { type, date, confirmed, successor { userId, name } }, areas[] { id, name, criticality, soleExpert, pack { packId, packKey, version, locale, name, own }, createdAt, archivedAt } }`
`coverage.json`	Coverage by area of expertise: the linked pack, the covered and all sub-areas, the share, and each sub-area with when it was covered.	`areas[] { areaId, areaName, keyPersonId, keyPersonName, pack, covered, total, share, categories[] { key, name, covered, coveredAt } }`
`packs.json`	The Customer’s own knowledge packs and the Tarumo packs the Customer has changed, with all their versions and sub-areas, unfinished pack drafts and the pack suggestions sent by experts in Mapping. Tarumo’s general packs only as named references.	`packs[] { id, packKey, basedOn { packId, packKey }, createdAt, versions[] { id, version, locale, name, description, vocabulary, reviewStatus, reviewedBy, contentHash, basedOnVersion { packKey, version }, createdAt, categories[] { key, position, name, description, questions } } }`, `drafts[] { id, packKey, packId, origin, locale, content, aiUnreviewedCategoryKeys, moderationStatus, revision, createdAt, updatedAt }`, `mappingSuggestions[] { id, author { userId, name }, locale, fit, targetPackKey, content, receivedOn, status, draftId, createdAt }`
`incentives.json`	Teams, team challenges as they were set up, reward settings and the reward granters. No challenge results, personal points or achievements.	`enabled`, `teams[] { id, name, createdAt, archivedAt }`, `challenges[] { id, title, teamId, teamName, target, startsOn, endsOn, rewardText, createdAt, archivedAt }`, `rewards[] { id, achievementKey, rewardText, createdAt, archivedAt }`, `rewardGranters[] { userId, name, assignedOn }`
`cards.json`	The published knowledge cards, in the knowledge card JSON structure.	`schemaVersion, generatedAt, organization, cardCount, cards[]`
`audit-log.json`	The organisation’s whole log, newest first, with no row limit: time, event, who, target and the event’s details. No card views and no card reports.	`entries[] { id, at, action, actorUserId, actor, targetType, targetId, target, metadata }`
`manifest.json`	Last: the structure’s version, the time of the export, the organisation, each file’s name, number of records, size in bytes and SHA-256 hash, and the lists of what the file leaves out and what Tarumo delivers on request.	`format, schemaVersion, generatedAt, organization, documentation, files[] { name, records, bytes, sha256 }, excluded, onRequest`

The file is made at the moment of the download, and no copy stays in Tarumo. The files are read one after another: if data changes during the download, the change may show in one file and not in another. Fields without a value are null. A reader must ignore fields it does not know.

Other files

Log (CSV): one row per event, newest first. Columns: Time (Finnish time), Who, What, Target and Details, in the user’s language. The file starts with a UTF-8 byte order mark (BOM) and every field is quoted. It holds at most the 10,000 newest events.
Mapping final report (Markdown): a report with figures for the whole organisation and for packs only, not for individual employees.
JSON files delivered on request: the same structure as the all-data ZIP file. The file of read and "helpful" counts per card has the card’s id and its reads and marks.

How to request an export

Send a written request to sales@tarumo.fi from the organisation administrator’s address. Say the organisation’s name and what you want: an export of the data, a switch to another service, or deletion only.
Tarumo delivers the requested JSON files within 14 days at the latest.
When you ask to switch to another service, the notice period is two months or a shorter period that you state. A 30-day transition period then starts, during which the service works normally, followed by an export period of at least 30 days. The Customer can extend the transition period once. Tarumo assists the switch reasonably (section 12 a of the terms of service).
After the export period, Tarumo deletes the Customer’s data permanently (section 12 of the terms of service).

During the contract and until the end of the export period an administrator can export the knowledge cards, all data as a ZIP file, the log and the reports without a request.

Questions

Questions about export can be sent to sales@tarumo.fi. Where the data is stored is described on the page Data location and access by authorities.