Study at least one migration away from an identified single-vendor component#
What this is, concretely#
This commitment consists of conducting, within an 18-month horizon, an in-depth migration study on at least one single-vendor component identified as strategic to you. The study is not a migration: it is the documented analysis that lets you decide, in full knowledge, whether the migration should be initiated, on what horizon, at what cost, towards which alternative. At the end of the study, you may perfectly well conclude that the status quo is the best choice — what matters is that the choice be informed rather than suffered.
The study typically covers four dimensions: a fine-grained identification of current usage (which features, what volumes, which integrations), evaluation of one or more alternatives (Valkey if Redis, OpenSearch or PostgreSQL if Elasticsearch, OpenTofu if Terraform, etc.), estimation of migration cost (technical effort, training, risks, duration), and analysis of the cost of non-migration (risk of unilateral flip, price hikes, end of support for your current version).
Why this commitment matters#
The commitment logically extends the audit (user-001). Without a migration study, the audit remains an observation. With a study, it becomes an operational option that can be activated if circumstances require. Many organisations that suffered the recent flips — Redis BSL/SSPL in March 2024, HashiCorp BSL in August 2023, MariaDB under K1 Investment Management in September 2024 — had not anticipated the event and found themselves in a weak position to react.
The commitment resonates with thesis 5 of the manifesto: “an open source project whose contributions, artefacts, or roadmap depend on a single sponsor is a revocable free project.” The migration study is precisely taking this revocability seriously: you do not bet on the flip not happening, you prepare your capacity to respond.
The collective effect is significant. When several European organisations seriously study an alternative — for example Valkey or KeyDB for Redis, OpenTofu for Terraform, OpenBao for Vault — the ecosystem of that alternative grows: feedback, code contributions, feature requests, paid maintainers. Thesis 11 of the manifesto underscores it: critical mass is what makes alternatives credible.
A concrete example#
A French agricultural cooperative of around a hundred employees, which has been using HashiCorp Vault as a secrets manager for its internal infrastructure since 2021, takes this commitment in April 2026 after the finalisation of the HashiCorp acquisition by IBM that completed in 2025. The horizon is 18 months. The IT department assigns an engineer for 20% of their time to the study.
By the sixth month, the inventory of usage is complete: 14 secrets managed, integration with three internal services via Vault’s HTTP API, manual rotation procedure. The study identifies OpenBao (fork of Vault under Linux Foundation governance since 2024) as the main alternative. A test environment is set up in parallel. By the twelfth month, the OpenBao PoC is functionally validated with near-complete compatibility of the existing integrations. By the eighteenth month, the cooperative has a full decision-support file: estimated migration effort of 25 person-days, possible switchover window in the following quarter, alternative tested and documented. Management decides to start the migration, but could equally have decided to defer it — the commitment is fulfilled in either case.
Anti-pattern to avoid#
A study that boils down to a comparison of product sheets on the Internet, without real technical testing or effort evaluation, is not a study. Symmetrically, a study you carry out in secret and then file without follow-through feeds neither your internal capability nor the ecosystem. The value of the study lies in its rigour (technical test, effort estimate) and its traceability (documented result, internal restitution, even anonymised publication).
Success indicators#
By the 18-month horizon, you can reasonably consider this commitment fulfilled if you have a written decision-support file on the migration studied, if at least one alternative has been technically tested (PoC or test environment), and if the final decision (migrate, defer, drop the idea) is documented with its justifications. Publication of an anonymised feedback report strengthens the collective value.
→ Documented in the dossier#
JSON schema category: migration. Default horizon: 18 months. Applicable to: businesses, public administrations, associations, foundations, research institutions.