If you hire an automation agency, are the workflows yours?

Unless the contract says otherwise, the workflows the agency built are probably not yours — and that matters far less than it seems. What determines whether you can switch providers painlessly is not the code: it is whose name is on the Meta account where your WhatsApp number lives, who holds the n8n encryption key, and who owns the API keys your flows consume. An n8n JSON can be rebuilt in hours. A WhatsApp number with two years of history cannot. Before signing, what you have to negotiate is access and exit, not intellectual property.

A note: this is not legal advice and StriqTech does not sell legal services. It is what breaks in practice when an SMB changes automation providers, and what to ask for so it does not break.

The five assets under discussion, ranked by what it costs to lose them

There is no single "this is mine": there are five different things with five different sets of rules.

1. The WhatsApp number and the Meta account where it is registered. Unrecoverable without cooperation, and the only item on the list you cannot simply buy again.
2. The conversation history and the contact database. If it is lost, it is lost.
3. The accounts and API keys your flows consume (OpenAI, Google, Tiendanube, Mercado Libre — the last two are the dominant e-commerce and marketplace platforms in Latin America — plus your ERP). Recoverable, but if they are in the provider's name you find out the day they get cut off.
4. The bot's corpus: the documents it answers from. You generated it, and you almost never have it in a usable format.
5. The workflows. The only thing contracts ever talk about, and the cheapest thing to rebuild.

The typical discussion starts at point 5 and never reaches point 1.

The WhatsApp number is the asset that cannot be rebuilt

If you use Meta's official API (Cloud API), your number does not live on its own: it is registered in a WABA (WhatsApp Business Account), and that WABA lives inside a Business Manager, now called a business portfolio. The question to ask, word for word, is: is the Business Manager in my company's name or the agency's?

If the portfolio is yours and the agency comes in as a partner, the day you leave you revoke their access from Business Settings and the number does not move: five minutes. If the portfolio belongs to the agency, you pay for the number and the line is in your name with the carrier, but the digital asset lives inside a structure you do not control.

With the provider's cooperation you get out of that with a migration of the WABA or of the number between portfolios: it gets coordinated, you need the two-step verification PIN, and it usually takes days without interrupting service. Verify the current procedure at the time you do it, because Meta adjusts it often, and expect that approved templates may need to be submitted again on the other side.

Without cooperation there is no button: what is left is a Meta support case with corporate documentation, or a new number. And a new number is not just changing the signage — the messaging tier starts at the bottom, the initial level is usually 250 unique recipients every 24 hours, and it climbs based on behavior over the course of weeks. You lose accumulated reputation, not a piece of contact data.

If your bot runs on Evolution API or any unofficial bridge, there is no WABA: there is a WhatsApp Web session tied to a SIM. The SIM is yours, but the session state, the synced contacts and the history live in the provider's instance, and that dump has to be required by contract.

n8n workflows are JSON, but without the encryption key they are half a JSON

An n8n workflow is exported from the interface, from the public API with a GET /api/v1/workflows, or from the console with n8n export:workflow --all --output=workflows.json. That gives you the complete logic: nodes, connections, conditions, code.

What it does not give you are the credentials: they are encrypted with the instance key (N8N_ENCRYPTION_KEY). The command n8n export:credentials --all --decrypted returns them readable, but it requires being inside the server and having that key. Without it, when you import the flows into a new instance you will see every node with its credential unlinked, and someone will have to re-enter each API key by hand.

That is where the deliverable almost nobody asks for comes from, and it is worth more than the JSON: the list of every external service your flows touch, with the account it belongs to and what it is used for. Twelve lines in a spreadsheet, and the difference between two hours of reconnection and two days of archaeology.

If your automation does not run on n8n, the detail changes but not the principle. In Make you export each scenario's blueprint as JSON from the interface. In Zapier there is no equivalent native export, so the only real protection is for the Zaps to live in your account with the agency added as a team member, not the other way around: if they are on the other side, the day you leave they get rebuilt by hand, one by one, looking at screenshots (n8n vs Zapier in 2026).

The bot's knowledge base is not the embeddings: it is the corpus

When the bot answers with RAG over your information, there are two things stored: the original documents and their vector representation in a database such as Supabase with pgvector, Qdrant or Pinecone.

Vectors are not portable. An embedding generated with OpenAI's text-embedding-3-small has 1,536 dimensions and only makes sense inside that same model: if the next provider uses a different one, everything has to be reprocessed from scratch. Asking for "the vector database" is asking for the residue.

What you have to ask for is the corpus: the PDFs, the exported catalog, the frequently asked questions, the price list, in their original format. Plus three things that usually live only in the head of whoever built it: how the text is split (chunk size and overlap), the system prompt and the human handoff rules. Those rules are months of fine-tuning against real cases from your business: they are yours by common sense, and it is worth making them yours in writing too.

Conversations are personal data and you are the controller

Here the legal ground is firmer than in the argument about the code. If your customers write to your company's WhatsApp, you are the data controller and the provider is a processor handling that data on your behalf. In Spain and Italy that means a processor agreement under Article 28 of the GDPR, with one very useful obligation: when the service ends, the processor returns or deletes the data according to what the controller chooses. In Argentina, Law 25.326 applies with equivalent logic.

If your support desk is Chatwoot, contacts come out as CSV from the interface and the full history through the API (/api/v1/accounts/ID/conversations) or with a pg_dump if the database is yours. If the provider runs a shared instance, they cannot give you the raw dump without exposing other clients — that is not bad faith, it is architecture — but the filtered export of your account they can.

Your own instance, a dedicated instance or a shared instance: what actually changes

Each architecture sets your portability floor before the contract says a single word.

Your own infrastructure. The Hetzner, DigitalOcean or Supabase account is in your company's name and you pay for it; the provider comes in as a collaborator. A VPS that can handle n8n plus Postgres costs between USD 10 and 25 per month. The day you change providers, you change a password. In exchange, someone has to run updates and verify the backups.

Dedicated instance on the provider's infrastructure. Your n8n and your database, but in their account. It is the most common setup and it is reasonable, because it saves you the administration. Portability depends on the contract: technically everything is transferable — a server can be moved between accounts, a database can be dumped whole, the encryption key can be handed over.

Shared multi-tenant instance. Every client on the same n8n. It is the cheapest to operate and that is why it exists. Your floor is the JSON of your workflows plus the export of your data: the encryption key and the raw dump will never be given to you because they are not only yours. If the monthly price is notably low, you are probably here. There is nothing wrong with it, but you need to know it.

The six questions you ask before signing, not after

They are the ownership subset of a longer provider evaluation (the 12 questions before hiring); these six are the ones that do not undo themselves later. Ask them by email and not by phone: the written answer is the one that is useful later if you need to make a claim.

1. Which company's name will the Meta Business Manager and the WABA be in? Ask for the WABA ID.
2. Will my n8n be a dedicated or a shared instance? Who holds the encryption key?
3. The OpenAI and Google keys and the integrations with my systems — are they on my account or yours?
4. In which cloud account and in which country do the database and the conversations live?
5. If I ask you for a complete export today, in how many business days does it arrive and what does it include?
6. If I stop being a client, what exactly happens on day 31?

The fifth is the most informative. A provider who works cleanly answers with a deadline and a list. One who improvises answers with a question.

The clauses to ask for, and the one that actually protects you

Four paragraphs are enough. You do not need a twenty-page contract for a USD 1,500 implementation.

• Ownership and license. Whatever is developed specifically for the client is assigned to the client; over the provider's reusable components, a perpetual, irrevocable, royalty-free license to keep operating and to modify. That closes the matter without asking the agency to give away its internal library, which is what stalls the negotiation.
• Account ownership. Listed one by one: Business Manager, WABA, domain, cloud account, AI provider accounts. In the client's name from day one.
• Export on demand. The right to request it at any time, at no cost, with a fixed deadline (5 business days is reasonable) and an exhaustive list of what it includes. Without the list, the clause is useless.
• Orderly reversion. 30 days of transition paid at the current rate, documented handover, and certified deletion of the data 60 or 90 days after the service ends.

And now the one that is worth more than the other four combined, because it does not depend on anyone's goodwill: an automatic backup to a destination you control. A workflow scheduled for Sundays at 3 AM that queries your own instance's API and drops the JSON of every flow into a Drive or a bucket of yours. Four nodes, twenty minutes of setup. Add the weekly contact export. The day there is a commercial conflict, you already have everything and the conversation changes tone on its own.

How an orderly exit is done, and what it costs to do it badly

A worked scenario using typical market ranges, not audited figures from a specific client. A 12-person dental clinic, 14 months with the same provider, six workflows in n8n (appointments, reminders, emergency triage, patient onboarding, invoicing, weekly report), a WhatsApp bot with RAG over 60 documents.

Orderly exit — accounts in the clinic's name and an export clause in the contract. Four weeks, in this order:

1. Week 1. Written notice of non-renewal and formal request for the export. Operations keep running and keep being paid for: nobody switches anything off yet.
2. Week 2. The package arrives. The incoming provider reviews it and reports what is missing before the relationship ends, which is the only moment when complaining is worth anything.
3. Week 3. Migration: import the flows into the new instance, load each credential, move the WABA if needed, run both systems in parallel for a couple of days.
4. Week 4. Cutover. The outgoing agency's access is revoked in Meta, in the cloud and in every integration, all keys are rotated, and the certified data deletion period begins.

The numbers for that exit: export included within 5 business days, transition month at the current rate USD 250, and 8 to 14 hours from the incoming provider at USD 45-70 an hour, between USD 360 and USD 980. Total USD 610 to 1,230, same number, history intact, no service interruption.

Disorderly exit — WABA in the agency's portfolio, shared instance, provider's OpenAI API key:

• Rebuilding the six workflows with no documentation, at the same rate: 25 to 40 hours, between USD 1,125 and USD 2,800.
• New number: the office sign, stationery, website, Google profile and Instagram bio, between USD 400 and USD 900 in design and printing. Plus the messaging tier again from 250 daily recipients.
• Templates: submit them again on the other side and wait for approval.
• 14 months of conversation history: not recoverable at any price.
• Total: USD 1,525 to 3,700, four to eight weeks, and the inquiries that keep arriving at the old number during the transition.

The difference between the two scenarios was not decided by a lawyer on the day of the fight. It was decided by whoever created the Business Manager on day one.

When you should NOT demand that everything sits on your infrastructure

This can be read as "ask for everything, host everything, control everything", and that would be bad advice for most of the SMBs that write to us.

If you have fewer than 50 people and no internal technical profile, owning the server means owning the problem. n8n ships new versions practically every week and some of them break nodes. Backups are useless if nobody has tested them with a restore. And when the bot stops answering on a Sunday at 9 PM, server ownership does not answer the phone. Having the docker-compose.yml in your hands does not give you autonomy if nobody on your team can read it: it gives you the illusion of autonomy, which is worse, because it makes you lower your guard on what actually matters.

The balance that works: the accounts in your name, the operation in the hands of whoever knows how to operate it. You own the Business Manager, the cloud account and the API keys, you have the weekly backup in your Drive, and you administer nothing.

It is also healthy to accept that there are things the provider rightly keeps: their internal node library, their starter templates, their monitoring stack. That is not your project, it is their product. Asking for it gets you nothing useful and complicates the negotiation over what you actually need.

The test you run in month 2, not in month 20

When the relationship is going well and nobody is angry, send a one-line email: I want the complete export package for internal archiving. See what arrives and how long it takes.

If what arrives is the JSON of the workflows, the list of connected services, the CSV of contacts, the bot's corpus and the text of the templates, you have a provider you can discuss anything else with. If it arrives late, incomplete, or with an explanation of why it is not necessary, you already know what it will cost you the day you want to leave — and there is still time to fix it.

StriqTech's free 15-minute audit is also useful for this: if you already have automations running with another provider, we review whose name each thing is in and what you are missing in order to move without losing the number. You do not need to hire us for that review. Write to us at info@striqtech.com.