Data Export, Retention, and Billing

What it is

Five Admin-section pages cover getting your data out of CMDash, controlling how long CMDash keeps it, reviewing who did what, and managing what you pay:

• Data Export (/data-export) — a full-fidelity, on-demand export of every table in CMDash that carries your organization's data, for data-portability (GDPR Article 20) purposes.
• Data Retention (/data-retention) — how long different record types (audit logs, automation logs, integration sync logs, posture snapshots, notifications, export jobs) are kept before automatic purge, plus a manual purge.
• Audit Logs (/audit-logs) — the organization's internal activity log: who did what, and (on qualifying tiers) a tamper-evident, cryptographically signed chain over those log entries.
• Plan & Billing (/settings/billing) and Enterprise Billing (/enterprise-billing) — subscription plan, add-ons, and (for Enterprise customers on a negotiated contract) invoices, purchase orders, and payments.

When to use it

• Responding to a data-portability request, or simply wanting a complete backup of your organization's data outside CMDash.
• Deciding, for compliance or storage reasons, how long CMDash should keep different categories of history — and clearing out anything past that window.
• Investigating who changed a setting or record, or producing independently verifiable proof that your audit trail hasn't been altered.
• Changing your subscription plan, an add-on, or — for Enterprise customers — managing a contract invoice.

Before you start

How to

Export your organization's data

1. Open Data Export from the Admin section.
2. Read the coverage banner — it lists live, from the running database schema, how many tables the export covers, plus a short list of tables deliberately excluded (credential and session material, not your data) and why.
3. Click Request Export. This is Owner-only — Admins can view and download an existing export but cannot start a new one.
4. Once complete, download the JSON archive, the CSV bundle (one file per table), or both from the Export History table below. Each download button asks the API for a freshly signed link when you press it, so a link never goes stale between the export completing and you clicking it.
5. Both formats also carry a configuration bundle — a redacted record of SSO, LDAP, integrations, notification rules, API keys, framework scope and custom fields. It exists because those settings live in tables the raw export withholds as credential material. No secret is ever read into it. See Retention & Export for exactly what is and is not in it.
6. Downloads expire 24 hours after the export completes. See docs/developers/data-export-format.md for the exact archive format if you're building an automated backup or migration tool against it.

Restore an export into a workspace

Open Organization restore from the Admin section, upload the JSON archive, read the dry run, then confirm. Owner only, and only into an empty workspace — the full guide is Organization restore. Self-hosted and licensed deployments only: on the hosted service the restore is refused.

What the export carries for proof

The archive carries your signed proof receipts as exact bytes, your public signing keys, and a transparency-log inclusion proof for each logged receipt (never your private signing key). See Exit guarantee.

Set how long CMDash keeps your data

1. Open Data Retention from the Admin section.
2. Set a retention period, in days, for each of six record types: Audit Logs, Automation Logs, Integration Sync Logs, Posture Snapshots, Notifications, and Export Jobs.
3. Use a preset (30 days, 90 days, 1 year, 2 years, 7 years) to set all six at once, or edit any field individually, then click Save Changes. Audit Logs are always kept at least 365 days: a shorter preset leaves them at 365, and a shorter value is refused.
4. The Purge Preview section shows how many records in each category would be deleted under your current settings. Click Run Purge Now to execute it immediately — this is Owner-only and cannot be undone.

Review and export the audit log

1. Open Audit Logs from the Admin section (it appears in the Compliance area of the sidebar).
2. Filter by an action prefix (e.g. user., integration.) to narrow the list, then click Export CSV or Export JSON for the filtered range.
3. If your tier includes tamper-evident audit, a second card shows the chain's status: chained-event count, the last signed checkpoint, how many events are awaiting chaining, and how many are unchainable. If the chain is off or unsigned, CMDash states that in red text rather than showing a false green state — a chain nobody signed is not weaker evidence, it is not evidence at all.
4. Click Export signed evidence to download an NDJSON file containing the audit rows, their chain entries, and the signed checkpoints covering them, for independent verification against CMDash's published public key.
   • Rows recorded when CMDash staff read or changed your organization (actions starting platform_admin.) show the staff member's IP address and browser (user agent) only in this file. Everywhere else you see audit rows — the Audit Logs page, its CSV and JSON exports, the SIEM stream, the audit evidence package and the full data export — those two values are blank on staff rows, because they are CMDash's staff-security data rather than yours. The signed export cannot blank them: each row's chain hash covers them, and a row changed after it was hashed would no longer verify.
5. Read the completeness caveat shown under the chain status: the chain proves recorded rows weren't altered, deleted, or reordered — it cannot prove every event was recorded, since audit rows are written best-effort from many call sites in the product.

Manage your plan and billing

Billing content lives primarily in a dedicated guide rather than here, to avoid two documents describing the same numbers differently:

1. Open Plan & Billing from Settings to see your current tier, usage against tier limits, and available add-ons. Changing plan or attaching/detaching an add-on requires Owner or Admin.
2. If your organization is on a negotiated Enterprise contract, open Enterprise Billing from the Admin section for contracts, purchase orders, and invoices.
3. For a full walkthrough of what CMDash records about money — subscriptions, invoices, MSP/vCISO statements — where each record lives, and how to reconcile it with an accounting system, see Billing & Accounting Export. For current prices, see the pricing page rather than this guide.

Common questions

Why can Admins view an export but not request one? Requesting a new export is restricted to Owner specifically — the same distinction Data Retention's purge makes — because both actions touch every table in the organization's data at once.

Does the export include CMMC/OSCAL submission documents? No. An OSCAL system-security-plan or assessment-results file for a specific framework is a separate, narrower artifact from this general-purpose export. It's available via the API today, and an export archive can be re-imported into a fresh organization on a self-hosted or licensed deployment. On the hosted service, restoring an archive is refused; see Exit guarantee.

What happens if I purge data by mistake? There is no undo. Review the Purge Preview counts carefully before clicking Run Purge Now — it executes immediately.

Is the audit chain always on? No — whether the tamper-evident chain runs, and whether checkpoints are cryptographically signed, are deployment-level configuration choices, not something a Command/Enterprise tenant automatically gets turned on by default. The Audit Logs page tells you plainly which state your deployment is in rather than showing a misleadingly reassuring status.

Related

• Billing & Accounting Export — the full billing reference this guide points to rather than duplicates
• Exit guarantee
• Developer reference: docs/developers/data-export-format.md