# Why It Becomes Hard to Remove ## Four things that compound the longer it runs The company's argument is that it sits in the data path and becomes the system of record, not a dashboard beside the network. Four mechanisms, in rough order of strength: **Data gravity.** Every month adds another month of enriched history that exists nowhere else. Leaving means losing the archive, and the archive is the product. **Compliance dependency.** Audit responses, DORA and PSD2 evidence, and incident reports get built on top of its retention and replay. Removing it breaks live regulatory processes rather than a report. **Integration breadth.** It sits between many upstream sources and many downstream consumers. Replacing it means re-architecting all of those connections at once. **Position in the path.** Because capture happens at the source, swapping it out means touching production DNS infrastructure, which is the change nobody wants to make. > [!tip] How the two halves fit together > Cost reduction is what gets the meeting. ==Data gravity and compliance dependency are what make the contract renew.== A saving can be competed away by a cheaper rival; three years of evidence that a regulator has already accepted cannot. ## Why it matters This is the part that decides whether it is a tool or infrastructure. Tools get replaced at renewal on price. Infrastructure gets budgeted around. The condition is time. None of these mechanisms exist at signature; they accrue with months of retained data. So the first production deployment matters far more than the first pilot, and the metric to watch is time from pilot to retained archive. ## Related - [[Red Onion MOC]] - [[Separating Capture Economics from Analytics Economics]] - [[data gravity]] - [[Data Moat]] - [[Switching Cost Design]] - [[Defensibility Principles MOC]] - [[7 Powers]]