How do I export all my site data?
Admin → Settings → Data Export builds a ZIP of your posts, members and settings. Links last 7 days, and secrets stay hidden unless you opt in.
Data Export gives you one ZIP with a complete copy of your site. Use it as a backup, to move elsewhere, or to exercise your right to take your data with you (GDPR Article 20). It keeps working when your site is read-only, so a lapsed subscription never traps your content.
How do I request an export?
Open Admin → Settings → Data Export and press Request export. It runs in the background, so you can close the page. When it's ready we email the address you're signed in with, and the file appears under Export history with a Download button and a checksum you can use to check the file arrived intact.
What's inside the ZIP?
- One .jsonl file for each kind of site data: posts, pages, categories, members, orders, forms, settings and so on. Each line is one record, so any developer tool can read them.
- A posts folder with one Markdown file per post, with a front-matter header on top (title, slug, date, status, tags).
- members.csv, a spreadsheet of your members with the non-secret columns only.
- owner_profile.json, your name, email, bio and social links. Never your password or sign-in tokens.
- MANIFEST.txt, which lists every file with its record count and SHA-256 checksum, and README.txt, a plain guide to the archive.
Operational logs and traffic statistics are left out: API and webhook logs, page-view and search analytics, affiliate clicks. They aren't content you created.
Are my images and files in the ZIP?
Not the files themselves. Every image, product file, course lesson file and post attachment is listed with a download_url that returns the real file when you open it. Those links last 7 days from the moment the export ran. Once they expire, run a new export to get fresh ones. The raw storage key is listed too, but a paid or private file can only be fetched through its download_url.
Who can download it, and for how long?
The site owner and administrators, while signed in. Teammates with a lower role can't request or download an export. The link in the email goes through VeloCMS rather than to a public address, so forwarding it doesn't hand the file to anyone else. The ZIP is kept for 7 days and then deleted. Its row in Export history switches to Expired, and you can simply request another.
What happens to my API keys and secrets?
By default, anything we store encrypted (Stripe keys, AI keys, mail credentials) is replaced with a REDACTED marker. If you need the real values, for example to run your own setup, tick Include decrypted secrets, confirm the warning, and request the export. The archive then holds those keys in plain text, and its row in Export history is tagged 'secrets decrypted'.
A decrypted export is as sensitive as a password. Keep it somewhere safe, never share it, and delete it once you're done. Anyone holding the file can act as you with those services.
Can I load an export back into VeloCMS?
Partly. Admin → Restore reads one file at a time, either a single .jsonl from the ZIP (posts.jsonl, say) or a .json file, and shows a preview with record counts before it writes anything. If a record with the same slug exists, you choose whether to skip it or add the new one with a suffix. Media entries are skipped, because the files aren't in the ZIP, and redacted secrets stay empty, so enter those again. It doesn't read the whole ZIP in one go, so unzip it first and upload the files you want.