Opinion · Architecture · Vendor lock-in

The perimeter

APIs documented. SDKs published. Integrations catalogued.
None of that is the test that matters at exit.

An Appice Perspective

A Moment to Think

Every vendor in the customer engagement stack today calls itself open. APIs are documented. SDKs are published. Webhooks are available. Integration catalogues run to hundreds of entries. Most of this is true. Most of it is also irrelevant. Openness measured at the moment of integration isn't the same thing as openness measured at the moment of exit. The first test is run once, at signing. The second is run only after the architecture has already failed. Most enterprises run only the first.

The mismatch isn't accidental. The vendor's commercial model depends on integration being easy and exit being costly. Open APIs sell licences; proprietary internals retain them. The architecture is the contract that survives both.

Openness has four operational properties

Real openness, in operational terms, has four properties. Each is either present in the architecture or it isn't, and each can be specified in writing before procurement begins. The brochure version of "open" satisfies none of them in full.

Exhibit 1

The four properties that distinguish architecture-open from brochure-open.

Each property is testable in advance, in writing. The architecture that has all four is rare and recognisable. The one that has none is the default sold as "open."

The most reversible piece of the stack is the most operationally important

The routing layer — which provider sends each push, each SMS, each email, each WhatsApp message — is paradoxically both the most operationally critical part of the customer engagement stack and the most architecturally undefended. In most enterprises today, this layer is implicit. The email vendor is hard-coded into the campaign tool. The SMS gateway is hard-coded somewhere in integration code. The push provider was chosen by the mobile team in 2018 and inherited by everyone since.

Reversible architecture makes this layer explicit. A Traffic Manager sits between campaign logic and delivery providers, abstracting each provider behind a single internal interface. The pattern looks like an integration detail. It is an architectural decision worth a quarter of switching cost.

Exhibit 2

The Traffic Manager pattern. One abstraction layer; four channels; many providers; substitutable in under an hour.

Providers become interchangeable per geography, per cost, per regulatory regime. WhatsApp BSP changes that take a quarter without this pattern take an hour with it. Beyond the channel layer, the same abstraction extends to data warehouse (Snowflake / BigQuery / Redshift / Databricks), AI model, CRM, analytics, and identity — six BYO boundaries the architecture preserves rather than absorbs.

Deployment is the architectural decision that is rarely reversed

The single most expensive architectural decision in customer engagement is rarely on a slide. It is the deployment topology, and the conditions under which it can change. On-premises means the data never leaves your boundary — increasingly the standard under RBI, SAMA, and equivalent regimes for systems of record. Private cloud (AWS GovCloud, Azure Government, GCP Sovereign) means residency under a sovereign certification. Hybrid is the most interesting pattern: the data plane stays where the regulator wants it while the control plane sits where operations want it. Multi-cloud means active-active across providers — not a disaster-recovery story but a sovereignty and availability story, where no single hyperscaler's outage takes the whole stack offline.

Exhibit 3

Four deployment topologies. Architecture that supports all four lets the enterprise move when the regulator moves.

The deployment choice is rarely reversed after first deploy. Architecture that can be deployed all four ways gives the enterprise the option to move when the regulator does. Architecture that can be deployed only one way commits the enterprise to whichever regime the vendor chose.

Open at integration isn't the same as open at exit. The vendor's brochure tests one. The reversibility test is the other.

The reversibility test

Open architecture isn't a marketing claim. It's four properties of the code (formats, statelessness, events, degradation), one routing pattern (Traffic Manager), six modular boundaries (data warehouse, AI, CRM, analytics, identity, open API standard), and four deployment options. Measured this way, very little of what is sold as "open" actually is. The question worth answering before the next procurement isn't whether the vendor claims openness. It's whether the architecture passes the reversibility test in writing. Specify the formats. Specify the routing abstraction. Specify the BYO contracts. Specify the deployment topology. Get answers, not adjectives. The cost of asking these questions in advance is hours. The cost of not asking them is the next migration.

What it actually takes to make leaving possible is a question this series will keep returning to.

About Appice. Appice is the real-time, audit-grade decisioning and execution layer for regulated industries. Deployed under operator control: on-premise, private cloud, or hybrid. A Moment to Think is a series on the decisions you'll act on for years. Read, discuss, and share.