Most procurement decisions focus on what a solution can do. Few organisations ask what it would take to move their content elsewhere.
The limitations may only become clear once the archive is established and the organisation needs to leave. By then, getting the content out can be much harder than anyone anticipated when the contract was signed.
This is what the preservation industry calls a walled garden. And it is more common than most buyers realise.
What is a walled garden?
A walled garden is a closed environment where your data is locked to the vendor’s solution. Not by force, but by design.
The most common lock-in forms are:
- No API, or an inadequate one. An API is the technical bridge that allows your archive to communicate with other systems. Without one, or with one that only covers a fraction of the solution’s functions, your content is siloed. Anything beyond the vendor’s own interface requires going back to them, at cost.
- Egress charges. Many organisations that move archives to cloud storage discover too late that transferring their own content carries a significant fee. The larger the archive, the larger the bill.
- Proprietary data structures. When a vendor stores content in a format only their own solution can read, migration requires format translation. That translation can be cost-prohibitive, and perhaps not even possible without data loss.
- Incomplete metadata export. A complete export should include not just the files, but everything that makes them meaningful: what they are, where they came from, what rights apply, their full preservation history. Losing that context on export means losing much of the usefulness of the collection.
What a walled garden costs you
The price of vendor lock-in extends beyond the cost of leaving. Well before this, it affects what an organisation can do with its archive and how much control it retains over its security.
When an archive cannot support a new integration, AI application or access workflow, the vendor may offer to develop the required functionality at additional cost. If that cost is prohibitive, teams are left maintaining inefficient workarounds that consume staff time and deliver only part of what was needed. It is commonplace that initiatives are ultimately abandoned because there is no viable path forward within the existing environment.
The financial costs compound over time. A submission to the ACCC’s Digital Platform Services Inquiry identified egress charges imposed by hyperscalers as a barrier to switching providers. The larger the archive, the more expensive the extraction, and the exit cost can become so high that organisations postpone or abandon migration altogether.
Vendor lock-in can also limit an organisation’s control over security:
- When a vendor’s security framework does not align with Australian standards such as Essential Eight, it increases the risk of gaps in the protections applied to the archive. Conversely, European or US driven security protocols may be too onerous for Australian needs.
- When AI tools are embedded without transparency, the organisation has limited visibility over how its intellectual property is being handled.
- When local support is withdrawn, unpatched and unsupported software becomes a security and business continuity liability.
- When content is breached or cryptolocked, recovery depends on whether the vendor can restore it and reinstate the correct controls.
A real-world example: Archives New Zealand
In 2022, Archives New Zealand experienced what limited visibility over a vendor-managed environment can mean in practice. Restricted archival records became publicly discoverable through its Collections search environment, supplied by Axiell. Approximately 9,000 restricted records were exposed.
Internal documents obtained by RNZ showed that Axiell knew about a synchronisation error linked to the breaches but did not initially inform Archives New Zealand. Once the issue came to light, Archives New Zealand took the public search tool offline.
The lesson is not that vendors are malicious. It is that when content lives inside someone else’s closed environment, visibility over what happens to it is limited, and accountability is difficult to enforce.
How to tell if you are already inside a walled garden solution
Walled garden vendors do not identify themselves as such. The onus is on the buyer to expose the constraints of their systems and the points of lock-in.
Warning signs to look for:
- Long contracts and long provisioning cycles
- Easy ingestion, difficult egress
- High-cost customisation for functionality that should be standard
- Infrequent release cycles; one or two updates per year are too few in the AI era
- No local Australian support
- A gap between what is promised during the sales process and what customers actually experience
Before signing, ask these questions about the API specifically:
- Can it perform every function that’s available in the User Interface?
- Is it open and documented so any developer can work with it independently of the solution vendor?
- Is it maintained in line with the core solution?
- Are there volume restrictions or throttling?
- Is it included in the base service, or priced as an enterprise add-on?
- Is it secured to the same degree as the main application?
- Are information rights and permissions respected by the API as they would be by the main application?
These questions establish how much freedom the API provides in practice.
What an open system means
Unlike a walled garden, an open system gives an organisation and its developers the maximum degree of freedom to build, integrate and use content in the ways they need.
A comprehensive, documented API allows the archive to connect with other systems and emerging technologies. With Retrieval-Augmented Generation (RAG), for example, AI can find and work with relevant archived content without requiring files to be manually retrieved and uploaded.
Preferred Media builds this openness into its managed archival service. Every client has access to its fully documented API, and there are no egress charges for retrieving content in this way.
This openness is backed by onshore, air-gapped preservation in Australian sovereign facilities. At least one tape copy is held offline in a geographically separate location, providing an air gap that keeps content recoverable.
Keep your options open
Preservation requirements will continue to change. Choosing an open ecosystem provides an insurance policy for procurement, allowing an organisation to keep using the archive it has implemented and populated while retaining the freedom to adapt, integrate or move its content in the future. Explore Preferred Media’s digital archive.
Planning your next procurement? Watch Preferred Media’s DPC pre-procurement webinar.
