Skip to main content

Export account data

Organization administrators can download retained customer data from Settings → Export account data when account exports are enabled. Choose the organizations and data categories you need, then download a ZIP containing CSV tables, structured data, and optional retained files.

Choose organizations and data​

  1. Open Settings and find Export account data. Managed-service administrators first choose a client organization.

  2. Select the parent organization, individual sub-accounts, or several sub-accounts. All sub-accounts selects the children you can administer; Whole account selects the parent and its children. Parent administrators can also export archived children.

  3. Select one or more categories:

    CategoryIncluded data
    Account detailsOrganization details and retained signup, consent, and support-access history
    Vendor reviewsVendors, review history, findings, questions, responses, document metadata, and retained public research
    Software analysesRepositories, scans, schedules, reports, retained file results, findings, and package-security evidence
    Organization settingsStored settings, effective inherited vendor settings and requirements, security policies, and branding
    Users and membershipsUsers, roles, child memberships, and repository access for the selected organizations
    Billing and usageRetained customer, subscription, billing-event, and usage metadata; requires the parent organization
    API key namesKey names and their organization references only

  4. Use Include retained vendor documents and branding for available attachments belonging to the selected categories. Original software source files and uploaded software archives are never exported; their retained findings and metadata remain in the tables.

  5. When Software analyses is selected, independently choose Include Markdown reports and Include PDF reports. Both are checked by default. Markdown includes retained file findings and summaries; PDF uses the assessment report layout. Reports include retained scan history and do not depend on the attachment checkbox. Tier 1 receives standard PDFs; Tier 2 and Tier 3 can include permitted organization branding. Branded PDFs embed the retained logo directly and do not download external images.

  6. Clear both report checkboxes and the attachment checkbox for tables and structured data only.

  7. Click Create export. One export can run per account at a time. You can leave Settings and return to Recent exports when it is ready.

  8. Click Download ZIP before the displayed expiration time. New exports expire 14 days after completion by default and never remain downloadable longer than 14 days. Follow the displayed time, which can be sooner when a shorter lifetime is configured. Existing exports keep their original expiration time. Use Cancel export to stop a queued or running export, or Remove download to revoke an existing download.

For example, choose a single child and Vendor reviews to export only that child's vendors and reviews. Choose all children and the same category to export those reviews together, with a separate folder for each child.

Use the download​

The ZIP contains a scopes/ folder with a separate folder for each selected organization. Each CSV has organization references and record IDs that link related tables. Software findings, external destinations, and licenses also have separate tables with one row per item.

Open CSV files in a spreadsheet using UTF-8 encoding. Text resembling a spreadsheet formula starts with an apostrophe to prevent execution. Long values use a plain-text reference such as [see scopes/child-7/structured/vendor_questions.jsonl#line=1] to link to JSON Lines files in each scope's structured/ folder. These companions preserve original approved values, nested records, nulls, and long text; the structured_record column identifies the file and its one-based line number. Dates use UTC.

README.md explains the format. schema.json describes table columns. manifest.json records the selection, snapshot time, record counts, and checksums. assets.jsonl lists included reports and retained attachments. Original software files and vendor documents deleted by retention do not produce missing-file entries or warnings. Each scope has a reports/index.csv (with a JSONL companion) linking source and scan IDs to the selected .md and .pdf files under reports/repo-{id}/. Report IDs keep historical scans separate.

Permissions and availability​

Exports require an active administrator session and administrator access to every selected organization. Members, read-only roles, and API keys cannot run exports. A child administrator can export the children they administer. A parent administrator can export the parent and children. Shared access to another account's repository does not include that account's data.

Administrators can also export retained data for their own platform administration organization and its permitted sub-accounts. The organization's platform designation does not hide the export card or grant access to other organizations.

Support Access exports require an explicit, active support session and enabled Support Access for that scope. Administrator access, ownership, and retention are checked again before completion and download. If access changes, create a new export after it is restored.

Exports contain retained data only. Deleted documents or file results are not reconstructed, and no new analysis or external research runs. Retained vendor findings and document metadata remain exportable after the original document is deleted. If an attachment changes or disappears while the export runs, create a new export to capture the current retained data.

API key values, hashes, previews, and key metadata are excluded. BYOK credentials, session tokens, invitation identifiers, report-sharing tokens, internal storage paths, and operational service data are also excluded. Retained vendor documents preserve their original contents. Original software source content and uploaded software archives are excluded.

Troubleshooting​

  • Report checkboxes missing after an update: Reload Settings after the deployment completes. Export controls use a content-versioned script so updated options are loaded through browser and CDN caches.

  • An older export lists thousands of unavailable source files: Generate a new export. Completed ZIPs retain the format they had when created; new exports exclude original software files entirely.

  • A selected report could not be rendered: Retry, select fewer organizations, or deselect PDF or Markdown reports to export the other format and data tables. A failed selected report format is not reported as a missing original source file.

  • Export card missing: Account exports may not be enabled, or your current role does not allow exports.

  • An export is already running: Wait for it to finish or cancel it before creating another.

  • Export too large: Select fewer organizations or categories, or exclude retained files. Each export supports up to 100 organizations, one million table records, 100,000 files, and 2 GiB of export data; individual structured records are limited to 16 MiB.

  • Data changed or was removed: A source was deleted, moved, or affected by retention while the export was being prepared. Create a new export after those changes finish. The rejected snapshot is not published; this does not mean your administrator permissions were revoked.

  • Download expired: Create a new export. If download authorization expires before the download starts, click Download ZIP again.