Vendor Lock-In: How It Happens and How to Avoid It

Vendor lock-in is what happens when leaving a provider costs so much in fees, lost data or rebuilt work that you stay even when the service no longer fits. You avoid it before you sign: get your data back in a usable format, keep the accounts and keys in your name, and make sure the contract lets you go without a penalty.

How vendor lock-in happens

Few providers set out to trap anyone. Lock-in builds up through ordinary choices:

• Exit fees. Charges for moving your own data out, or early termination fees that make leaving expensive.
• Formats only one tool reads. Your records exist, but only inside the app that made them.
• Accounts in their name. The domain, the hosting, the AI account or the software licenses belong to the provider, not to you.
• Licensing limits. Software you already pay for only runs in that provider's environment.
• Knowledge in one head. Nobody wrote down how your setup works, so the next provider starts from zero.

Each of these looks harmless on the day you sign. They add up over the years, and most owners find out how stuck they are on the day they try to leave.

Regulators have noticed vendor lock-in

The Federal Trade Commission reported in November 2023, after asking the public about cloud computing, that commenters said egress fees could discourage customers from using more than one provider, and that some described minimum-spend contracts as a lock-in mechanism. Commenters also pointed to licensing practices that limit where certain software can run.

In the UK, the Competition and Markets Authority's final decision of 31 July 2025 on cloud services concluded that "competition is not working well." It found that very few customers switch, and named egress fees as a key commercial barrier that falls hardest on smaller customers and those with a lot of stored data.

In Europe, the rules are changing. The European Commission's guide to the Data Act says the law will make switching cloud providers free, fast and fluid, and will entirely remove switching charges, including charges for data egress, from 12 January 2027. Until then, providers may still charge for the costs they incur in switching and data egress.

1. Nov 16, 2023 FTC publishes what it heard. Commenters on its cloud computing request described egress fees and minimum-spend terms as lock-in.
2. Jan 11, 2024 Data Act enters into force. A transition starts in which providers may charge only the costs of switching and egress.
3. Jul 31, 2025 UK regulator's final decision. The CMA finds competition in cloud services is not working well, with egress fees a key barrier.
4. Sep 12, 2025 Data Act applies. The EU rules, including the switching chapter, begin to apply.
5. Jan 12, 2027 Switching charges end in the EU. Providers can no longer charge for switching or data egress.

What vendor lock-in costs a small business

The bill for leaving is only the visible part. The bigger cost of vendor lock-in is leverage. When a provider knows you cannot leave, a price rise, a slow response or a change in service terms becomes something you absorb rather than something you negotiate. If the provider is bought or shuts a product down, its roadmap becomes your roadmap.

There is a security cost too. If only the provider knows which accounts exist and where the backups live, you cannot check its work, and you cannot hand the systems to anyone else quickly in an emergency.

Questions that expose vendor lock-in before you sign

1. If we leave, what do we get back, in what format, and how fast?
2. Whose name is on the domain, the hosting account, the AI accounts and the licenses?
3. What does it cost to leave, including data transfer and early termination?
4. Who owns the custom work we paid for?
5. Is our setup written down well enough that another team could run it?

A provider that answers these cleanly expects you to stay because the work is good. A provider that hedges is telling you how they plan to keep you.

An exit checklist you can run this month

You do not have to wait for a contract renewal to find out where you stand. Run these checks with your current providers:

1. List every account. Domain, hosting, email, AI, software licenses and payment processors, with the name each one is registered to.
2. Request an export. Ask for your customer records, files and content, and open them in a different tool to confirm they are usable.
3. Collect the keys. Make sure administrator access for each account is held by your company, not only by the provider.
4. Read the exit terms. Find the notice period, any termination fee and any charge for moving data out.
5. Check the documentation. Ask for a written description of how your setup works, good enough for another team to pick up.

How LTFI handles it

LTFI is built so the reasons to stay are the work itself. Your company gets its own server, which Kief Studio manages. Your AI runs on keys you own, under your contract with the AI company, billed to you at cost. LTFI does not care which AI provider you use and works with models on a server you run, so you can change providers without changing how your team works, and spend caps keep the bill where you set it. Your contacts, files and content are yours, and if you leave, we export them for you. Read about bringing your own AI key, see what LTFI does, or compare managed and self-hosted options. Our note on owning your infrastructure covers accounts, keys and custom code in more depth.

Frequently asked questions