11x Data Export and Migration Checklist

An 11x migration begins by controlling autonomy, not downloading contacts. An agent may be selecting accounts, researching people, sending messages, placing calls, creating tasks, handling replies, scheduling meetings, or writing outcomes into a CRM. The exit is unsafe if any of those actions can continue while operators copy an incomplete and changing data set.

This checklist is based on public official documentation reviewed August 8, 2026. Gangly did not operate an 11x tenant or execute its export. Public documentation did not establish a complete bulk-export schema for agent state, prompts, AI decisions, approval history, credits, or all relationships. That is an evidence gap—not proof that a support-assisted or contractual path is unavailable.

Define the 11x exit boundary

This page owns incumbent exit control. Use Gangly vs 11x for the product choice, the AI SDR guide for category education, and AI SDR vs AI sales assistant for the autonomy boundary. A migration is a separate job: preserve evidence, prevent duplicate actions, move accepted data, and close access.

Freeze the source tenant, order form, DPA, plan, users, connected CRMs, mailboxes, domains, phone numbers, calendars, cutoff, target, archive, legal holds, rollback window, cancellation, retention, and deletion dates. Name owners for sales operations, CRM, email, voice, security, privacy, legal, finance, validation, vendor support, target administration, and rollback.

Write hard gates before extraction: no unapproved customer-facing action; no duplicate email, call, task, or meeting; complete suppression and consent controls; accepted critical CRM relationships; visible failures; least privilege; tested rollback; and written closure evidence. A high overall match rate cannot override a missing unsubscribe or an agent that can still send.

Inventory agents, audiences, channels, CRM, and governance

Inventory organizations, workspaces, users, administrators, roles, teams, agents, agent versions, personas, instructions, prompts, ICP definitions, segments, account lists, contacts, research, enrichment fields, source URLs, confidence, playbooks, sequences, steps, templates, variants, schedules, time zones, throttles, branch rules, human-approval points, and escalation rules.

Add mailboxes, domains, DNS and authentication records, sender identities, phone numbers, call flows, calendars, connected accounts, messages, calls, tasks, replies, bounces, unsubscribes, meetings, outcomes, notes, transcripts, recordings, research evidence, custom variables, CRM mappings, CRM object IDs, owners, activities, credits, usage, errors, logs, AI decisions, reasons, source evidence, human approvals, overrides, suppression, consent, permissions, audit history, retention, deletion state, credentials, webhooks, and API clients.

Each inventory row needs an artifact type, stable source ID, parent ID, related IDs, business owner, data owner, authority, format, version, source timestamp, count, portability label, export route, target, retention class, legal hold, validation test, and evidence link. Coordinate the CRM portion with the CRM migration checklist and channel state with the cold-email platform migration checklist.

Label portability; never infer it from ownership

Use five labels: documented exportable, buyer verified, support/contract dependent, reconstruct, and unavailable. Record the official URL or ticket, plan, permission, requester, format, schema, relationship/history coverage, sample date, errors, and exclusions behind every label.

Current 11x terms define customer ownership of Customer Data and Performance Data as between the parties. They also define Performance Data broadly enough to include logs and usage data. Ownership is important, but it does not prove an in-product button, bulk endpoint, stable schema, complete relationship graph, export deadline, or media availability.

Therefore default prompts, internal agent configuration/state, playbook logic, decision traces, approval history, enrichment provenance, usage/credit history, retries, model metadata, complete sequence state, and audit history to support/contract dependent until verified. Screenshots may document configuration but are not a complete, machine-readable export. Ask 11x for an object-and-relationship manifest, supported methods, limits, rate constraints, formats, history windows, unavailable fields, and the repeatable final-delta process.

Map stable IDs, edges, authority, and evidence

A contacts CSV loses the workflow. Build edge tables for agent→persona→ICP→playbook; account→contact; contact→research source and consent state; sequence→step→message; contact→enrollment; mailbox/domain→sender; call/message→reply; reply→meeting→outcome; task→owner; artifact→CRM object/field; AI decision→input evidence→rule→human approval; and user/team→permission.

The official 11x CRM integration page describes emails, research, replies, call status, outcomes, transcripts, and custom variables writing to chosen CRM fields, along with read/write controls. That makes the CRM a critical parallel evidence source, not proof that 11x exports every source artifact or relationship. Preserve 11x IDs where available alongside CRM IDs, timestamps, owners, direction, authoritative system, and conflict rule.

Create an authority register using the CRM integration guide. For every field and action state who may read, propose, approve, create, update, suppress, delete, and replay it. Keep suppression and consent authoritative throughout the move. Never let a target infer permission to contact from record presence.

Stop autonomous actions before the final delta

1. Freeze new campaigns, agent changes, prompts, playbooks, lists, mappings, permissions, mailboxes, domains, calling configuration, and integrations.
2. Record active agents, enrolled contacts, queued and scheduled messages/calls/tasks, open replies, meetings, pending approvals, retries, errors, and CRM write queues.
3. Pause new enrollments and prospect discovery. Then stop new outbound sends, calls, task creation, meeting creation, and mutating CRM writes using a vendor-confirmed order.
4. Drain or explicitly cancel in-flight work. Decide the disposition of every queued action; do not let it silently reappear after rollback.
5. Keep unsubscribe, bounce, reply, complaint, do-not-call, consent withdrawal, and inbound capture paths working until the final delta is preserved.

11x’s Alice page describes autonomous targeting, research, engagement, reply handling, scheduling, and CRM synchronization. That operating scope explains why a pause must cover customer-facing actions and downstream writes—not just campaign creation. Document who confirmed the stop, UTC time, observed queue state, and negative test proving the source can no longer act.

Preserve a snapshot, final delta, and immutable manifests

Take a pre-stop snapshot, capture the stop log, then extract a final delta for late replies, bounces, unsubscribes, call outcomes, meetings, approvals, errors, retries, and CRM updates. Keep the source readable until extraction is repeatable, acceptance is signed, and rollback expires. Never deactivate a mailbox or revoke CRM access before the source state needed for final reconciliation is captured.

For every file or API batch record tenant, request, filters, time range, schema/version, file name, format, rows, bytes, page count, errors, exclusions, source timestamp, requester, and SHA-256. NIST’s Secure Hash Standard supports file-identity checks; a matching digest does not prove that an export contains every row, field, edge, or history event.

Preserve raw exports unchanged and perform transformations in versioned copies. Keep mapping rules, code, logs, rejects, manual edits, vendor tickets, screenshots, approvals, and signed manifests in the evidence pack. Secrets belong in a secret manager; the manifest should reference the credential owner and rotation record, never copy the secret.

Reconcile counts, fields, messages, edges, and history

• Count reconciliation = accepted target artifacts ÷ eligible source artifacts.
• Field fidelity = correctly transferred eligible values ÷ eligible tested values.
• Message fidelity = messages with correct body/version, sender, recipient, time, channel, status and thread ÷ eligible messages.
• Edge reconciliation = correct agent, contact, sequence, message, outcome, owner and CRM relationships ÷ eligible edges.
• Decision evidence coverage = accepted decisions with source, rule/version and required approval ÷ eligible decisions.
• History coverage = accepted required events, errors, overrides and versions ÷ eligible required history.

Define eligibility and exclusions before extraction. Full-reconcile suppression, consent withdrawal, complaints, active contacts, scheduled actions, human approvals, sender identities, permissions, CRM mappings, and destructive actions. Stratify samples by agent, persona, channel, time, outcome, owner, language, region, error, and artifact age. An email attached to the wrong person or a meeting without its approval/source edge fails even if both records exist.

Run negative tests: duplicate and replay, late and out-of-order reply, missing account, merged CRM contact, changed owner, revoked token, deprovisioned user, rate limit, provider rejection, corrupted file, absent source URL, prompt injection in research, and suppression arriving during cutover. Require visible quarantine, bounded retry, manual resolution, and rerunnable reconciliation.

Stage the target and dual-run one authority

Build target users, roles, personas, ICPs, playbooks, message templates, schedules, CRM maps, mailboxes, domains, phone configuration, suppression, consent, and monitoring while every external action is disabled. Load a consented golden set with expected fields, edges, decisions, approvals, prohibited actions, and outcomes. Validate create, update, merge, delete, reply, bounce, unsubscribe, call outcome, meeting, owner change, retry, and rollback.

Use shadow evaluation where possible: the target may calculate or draft, but only the named production authority may send, call, create tasks, schedule meetings, or mutate CRM fields. Compare decisions, evidence, proposed content, suppression, routing, associations, errors, operator effort, and cost. Do not dual-run two autonomous agents against the same audience.

NIST’s AI Risk Management Framework offers a general governance structure, not an 11x migration procedure. Operationalize governance through named owners, traceable source evidence, approved limits, human escalation, hard stops, incident handling, and monitored residual risk.

Cut over with hard gates and prove rollback

Approve cutover only when autonomous source actions test disabled; the final delta is accepted; critical suppression, permissions, messages and edges reconcile; target actions pass the golden set; monitoring and on-call ownership work; and rollback has been rehearsed. Canary a low-risk, consented segment before expanding.

The runbook should state: source stop, final-delta timestamp, target activation, authority transfer, DNS/mailbox/phone/CRM changes, validation queries, monitoring interval, abort owner, and rollback deadline. Rollback disables target actions first, preserves target-only events, reverses only approved reversible writes, restores the accepted source configuration, imports new suppression/replies, and prevents queue replay.

Stop for any unauthorized send/call/write, duplicate customer contact, lost suppression, critical wrong CRM association, missing required approval, untraceable AI decision, exposed secret, invisible failure, or untested rollback. See the cold-email compliance guide for channel-specific review; this checklist is operational guidance, not legal advice.

Decommission, revoke access, and collect deletion evidence

After acceptance and hold review, remove agent execution rights; disconnect mailboxes, domains, calendars, phone systems and CRM connectors; revoke OAuth grants, API keys, webhooks, service users, SSO, support access and vendor accounts; rotate shared credentials; remove allowlists; and test access fails. Preserve required archives under restricted ownership.

The current terms state that, on request after termination, a party returns or destroys the other party’s confidential information within seven days, subject to customary backup and archival processes. Apply the executed agreement, DPA, order form, laws, holds, retention exceptions, and counsel. Request written scope covering Customer Data, Performance Data, contacts, messages, calls, recordings, transcripts, research, prompts, outputs, logs, exports, support artifacts, subprocessors, backups, exceptions, and completion date. Cancellation is not deletion.

Apply the worked example and calculate TCO

This fictional example is arithmetic, not an 11x result. A team defines 10,000 eligible contacts and accepts 9,800; 8,000 eligible messages and accepts 7,840 with correct thread metadata; 2,000 critical edges and accepts 1,920; 1,000 suppression records and accepts all 1,000; and 100 sampled AI decisions, of which 90 retain the required source and approval evidence.

The team does not average these into one reassuring score. Suppression passes its hard gate; decision evidence and critical edges remain exceptions until accepted or remediated. TCO = source overlap and exit support + target license/setup + export/API/support charges + data/provider and channel infrastructure + reconstruction + engineering + CRM administration + security/privacy/legal + validation + monitoring + rollback + archive + deletion. Use written quotes and measured labor.

Print the 11x migration checklist

Gangly is not a general destination for 11x agent state and does not make vendor configuration portable. If it is evaluated as a downstream rep-workflow layer, test it separately with the same authority, CRM, suppression, evidence, failure, rollback, security, and TCO controls.