Data Export & Retention
CVD Portal has these ways to export your data.
| Export | How | Plan | Format |
|---|---|---|---|
| Whole workspace (users, reports, products, SBOMs, evidence metadata, settings, audit log and more) | Settings → Account → Export your data. Admins only | All plans, including Free | HTML, CSV or JSON |
| Whole workspace, the same data set as Settings, for switching provider | GET /api/v1/account/export?format=json or ?format=csv with an API key whose only scope is account:export | All plans, including Free | JSON, or CSV in a ZIP |
| All company data (users, reports, webhooks, API key metadata, audit log) | GET /api/v1/gdpr/export with an API key that has the gdpr:export scope | Enterprise | JSON |
| Vulnerability reports, up to 100 for each request | GET /api/v1/vulnerabilities/export with the read scope | Enterprise | JSON |
| Auditor evidence package | Dashboard. See How do I export an auditor evidence package? | See the linked page | See the linked page |
| CSAF advisory for a report | Report page. See CSAF Advisory Export | Reporting | CSAF JSON |
The full data export includes up to 10,000 audit log entries and their hash chain values. It does not include uploaded evidence files. Their records are included. It removes the IP address from audit entries older than 90 days. You can run it 5 times each hour.
Export through the API on any plan
Any plan can create an API key whose only scope is account:export. Go to Settings → API keys, create a key, and select only that scope. A key with any other scope still needs Enterprise.
curl -H "Authorization: Bearer $CVD_KEY" \
-o export.json \
"https://cvdportal.com/api/v1/account/export?format=json"
The JSON file has exportedAt, company and sections. Each section has a key, a label and rows. The full list of sections is on the EU Data Act page.
Switch to another provider
Send a written request to security@cvdportal.com. The switch ends within 30 calendar days, and you then have at least 90 days to retrieve your data. Switching is free of charge. On request, we deliver your uploaded evidence files and the full audit log during the switch. The rules are in section 7 of the Terms of Service and on the EU Data Act page.
Retention
You cannot set retention or deletion rules for your data. CVD Portal does not automatically redact or delete report details.
CVD Portal never deletes audit entries for CRA Article 14 actions. The privacy policy states that operational audit entries, for example logins and page views, are kept for 12 months.