Palantir's Moat Isn't the Software. It's That Leaving Means Leaving Your Own Data Behind.

NHS England has faced sustained pressure from MPs, clinicians, and campaign groups to exit or retender Palantir's contract — but has not done so. The FDP contract, awarded competitively in November 2023 following an open tender, is structured with a seven-year maximum term (an initial three-year commitment extensible by a further 2+1+1 years), with the first break point arriving in spring 2027.¹¹ Officials and critics alike have noted that the longer Palantir's platform runs, the more NHS data workflows will be shaped around it — making a future switch increasingly costly.⁷ That sentence is the entire moat in miniature. The lock-in isn't that you signed with Palantir. It's that your own data now speaks a dialect only Palantir is fluent in.

The official story is that Palantir's clients are locked in forever — switching costs so high they approach infinite, especially for governments. That is half right and half marketing. Palantir's own SEC filings flatly disclose that the majority of its contracts carry termination-for-convenience provisions.² A contract you can cancel at will is not infinite lock-in. So the bull narrative is pointing at the wrong thing. The cancellation clause is wide open; it's the data, the precedent, and the consolidation that close the door.

The moat is three locks, and none of them is the code

Strip away the assumption that Palantir's edge is proprietary brilliance, and a more durable — and more honest — structure appears. The stickiness rests on three compounding lock-ins, each of which works even if a competitor's software were just as good. The first is data-format gravity: once an institution has run its records through Palantir's platforms for years, the records take on the platform's shape. The NHS decision not to exit the contract early wasn't loyalty; it was the accumulating cost of workflows and data pipelines built around Palantir's platform.⁷ The data is the hostage, and the institution paid the ransom every year just by continuing to operate.

The second lock is judicial, not technical. A prior litigation outcome established a legal obligation for the government to consider Palantir before building competing systems in-house. In 2016, Palantir sued the Army over the DCGS-A program, winning a ruling that the Army had violated the Federal Acquisition Streamlining Act by failing to determine whether commercially available products could meet its needs; the Federal Circuit affirmed that injunction in 2018.⁹ That precedent — Palantir v. United States, not the reverse — is what obliged the government to look at the commercial incumbent first. If accurate, that is a switching cost no engineering team can remove: the buyer is obliged to look at the incumbent first, by law, before it is allowed to leave. The third lock is consolidation. On July 31, 2025, the U.S. Army awarded Palantir an Enterprise Agreement that folds 75 prior contracts into a single vehicle for the Army's future software and data needs.⁵ Seventy-five separate procurement battles a competitor might have picked off one by one become a single fortress that has to be taken whole.

Notice what every row of that table has in common: the lock holds even though Palantir's contracts can be cancelled at will. The customers aren't trapped by the paper. They're trapped by the cost of the world they built on top of the paper. That is why the right read of Palantir is a membership-of-inertia, not a vault with no exit.

What the retention numbers are actually showing

The financials behave exactly the way a data-gravity moat predicts. Palantir's top-three customers have been with the company an average of nine years, and the average revenue from a top-20 customer climbed to $64.6 million in 2024, up from $54.6 million the year before.¹ That is the signature of accounts that don't leave and quietly spend more each year — the data deepens, the workflows multiply, and the cost of leaving rises in lockstep. The platform design reinforces it: AIP is bundled directly into the existing Foundry, Gotham, and Apollo stack, and Apollo pushes continuous updates into cloud, on-premises, and classified environments alike.⁴ Every update is another root the customer didn't ask for and now can't easily pull up.

The growth around those locked accounts is genuine, not a rounding error. In Q3 2025, total revenue hit $1.181 billion, up 63% year over year, with U.S. commercial revenue up 121% and total contract value up 151%.³ A moat that was merely defensive wouldn't expand like that. But the expansion and the lock-in are the same mechanism: new deployments become tomorrow's data gravity, and the company that can't leave today is the company spending more next year.

If the data is the moat, can't the data revolt?

The fair objection cuts the other way: if the moat is built on the data rather than the contract, then whoever controls the data — or how people feel about it — controls the moat. And at the NHS, the people are not quiet. Roughly 50,000 patients wrote to NHS trust boards opposing Palantir's adoption, and the British Medical Association told doctors to limit their engagement with the Palantir-run platform, with BMA council chair Tom Dolphin writing in the BMJ in February 2026 that doctors could no longer provide the tacit endorsement that using the product implies.¹⁰ Data gravity holds an institution in place; it does not hold legitimacy in place. A moat that depends on years of accumulated records is exposed precisely where those records are contested — and a termination-for-convenience clause is a much easier lever to pull when 50,000 of your constituents are demanding you pull it. The honest version of the bull case is not 'they can never leave.' It's 'leaving is expensive enough that, absent a political crisis, they won't bother.' That is a real moat. It is not a permanent one.

Palantir is often sold as a company the government cannot remove — a piece of permanent infrastructure that arrived, fittingly, with a small early check from the CIA's venture arm (about $2 million, against the roughly $30 million Thiel's circle put in at the 2003 founding).⁶ The origin myth flatters the moat. The truth is more interesting and more fragile. Palantir didn't make itself impossible to fire. It made itself expensive to replace — by turning every client's own data into a reason to stay. The moat isn't a wall around Palantir. It's the weight of everything the customer left inside.