# Customer guarantees

URL: /systems/trust-and-governance/customer-guarantees · Id: `page:systems/trust-and-governance/customer-guarantees`

> What every Customer of every Startup is owed by construction, from an honest agent and a reachable person to online cancellation and a log of every access.

Every [Customer](/business/nouns/customer) of every [Startup](/business/nouns/startup) gets the same guarantees, whatever the Startup sells and however few people run it. The platform enforces each one, and no Startup can switch one off.

## The guarantees
| Guarantee | How it holds |
| --- | --- |
| You know when an agent acts | Every agent [Message](/business/nouns/message) names an agent sender, and every [Action](/business/nouns/action) records whom it was `by` and `for` |
| You can reach a person | Asking for a person opens a [Task](/business/nouns/task) for a [Human](/business/nouns/human), answered within the time the terms state |
| Cancelling takes no more than buying | A [Subscription](/business/nouns/subscription) bought online cancels online, in no more steps than it took to buy |
| Your terms stay fixed | Every [Version](/business/nouns/version) of the terms you accepted stays served at its own address, and a material change reaches you before it applies |
| Your data leaves with you | You export everything in your [Tenant](/business/nouns/tenant) at any time, in open formats |
| Erasure is final | A request to erase stops every read of the record and every message to you |
| Your data stays where promised | The residency a Startup declares applies to every copy and backup |
| You see every access | Your Tenant's activity log lists every read and write, by whom and for what reason |
| One opt-out reaches every sibling | Unsubscribing from one Startup stops promotion from all its siblings within the hour |
| Your money moves on a licensed rail | Payments run only through Stripe, and refunds follow the terms you accepted |

## Knowing when an agent acts
An agent never poses as a person. When an agent writes to you as itself, the sender says so. When it writes for a person who granted it a [Mandate](/business/nouns/mandate), that person is the author of record and answers for what it sends.

Every Action carries both names, so the record always shows who acted and on whose behalf.

## Reaching a person
A Startup with no staff still has a person behind it. A request for a human reaches the Startup's own Human when it has one, and otherwise the person who answers for the Startup's [Company](/business/nouns/company).

The reply time is part of the terms, and the first answer states when the person replies. A Task past due escalates, and the overdue Task records the miss. The [response clocks](/systems/customer-service/response-times) hold every number.

## The activity log
Your Tenant's log lists every read and write: the [Worker](/business/nouns/worker), the Action, and the [Purpose](/business/nouns/purpose) it served. When a support agent views your Tenant as you see it to fix a problem, the log records the view, its reason and its length.

A freelance translator asks her invoicing agent about a billing error. The next morning, her log shows one support read of her last three invoices, and why.

## Next
- [Your data](/systems/trust-and-governance/your-data): ownership, export and erasure in full.
- [Customer paper](/systems/legal-and-corporate/paper): the terms these guarantees live in.