With the data export, you save all data of an organisation as a ZIP file, for example before a cancellation or for your own archive. This article is aimed at Tenant Admins and at ISMS managers who confirm an export, and also explains what happens to your data in the event of a cancellation.

Before you start

  • An export is requested by a Tenant Admin under Administration › Data export. The data export is available in all plans.
  • The export is confirmed by a person with the ISMS manager role of this organisation, never by the person who requested it (four-eyes principle). Because every Tenant Admin is automatically ISMS manager, a second Tenant Admin can also confirm.
  • Only one open request per organisation is possible at a time.

What the export contains

The ZIP file contains all data of the selected organisation: one file in JSON format per area (e.g. risks, assets), a table of contents and all uploaded files, such as evidence, policies and documents. If you have several organisations, request the export for each one separately.

How to do it

  1. Tenant AdminRequest export

    One open request per organisation.

  2. ISMS managerConfirm

    Never the person who requested the export.

  3. Tenant AdminsDownload

    For 7 days.

Rejected

With a justification; no file is created.

After 7 days

The file is removed; the request remains in the list as evidence.

Data export with the four-eyes principle

A Tenant Admin requests the export of an organisation. A person with the ISMS manager role of this organisation confirms it, never the person who requested it. The ZIP file is then created immediately, and Tenant Admins can download it for 7 days. If it is rejected, no file is created. After 7 days, the file is removed; the request remains as evidence.

  1. Open Administration › Data export.
  2. Under Request export, choose the Organisation.
  3. Click Request export.
  4. The ISMS manager of the organisation receives the task Confirm data export under My tasks and, on the Data export page, clicks Confirm and then Confirm and create. With Reject and a justification, they decline the export; no file is then created.
  5. As soon as the status shows “Ready to download”, click Download.

What happens next

  • After confirmation, the file is created immediately. The person who requested the export receives a “Data export ready” email. The email does not contain a link to the file; you download it in Varmo.
  • The file can be downloaded for 7 days, by Tenant Admins only. After that, the request shows the status “Expired” and the file is removed. The request itself remains in the list as evidence.
  • The request, confirmation or rejection and every download appear in the Administration log.

The list on the page shows the status of each request: “Awaiting confirmation”, “Being created”, “Ready to download”, “Rejected” (with justification), “Expired” or “Failed”. If an export has failed, request it again.

What happens to your data in the event of a cancellation

A Tenant Admin cancels under Administration › Account & contacts in the Cancellation section with Cancel account. The cancellation applies to all organisations of the account and cannot be withdrawn.

  1. Until the end of the subscription, you continue working as normal. The subscription ends with the current billing interval; there is no further debit or invoice.
  2. After the end of the subscription, sign-in is locked for all people.
  3. After the deletion period, all data is permanently deleted. You set the deletion period in the Account section (between 30 and 365 days, default 30 days). The exact date of permanent deletion is shown in the Cancellation section after cancellation.

All Tenant Admins receive a confirmation of the cancellation by email.

Retention

Under Administration › Account & contacts › Retention, you set how many years (1 to 10, default 2) the sign-ins (who signed in when) are kept; older entries are deleted every night. The change log is kept as long as the organisation exists.

Frequently asked questions

Can I export only part of the data?

No. The export always covers all data and files of an organisation.

Why does someone else have to confirm the export?

The file contains confidential data of your ISMS. Confirmation by the ISMS managers ensures that no export is created unnoticed.

What happens when the 7 days have passed?

The file is removed. If you need it again, request a new export.

You find more on the four-eyes principle under Regulating approvals with the four-eyes principle.