AWRA Help Center

Open Settings → Security & Devices → My Account & Danger Zone. The card Export everything in this organization appears only for people whose role has the Export Organization Data permission. The Admin role has it; give it to anyone else on purpose, because the file holds everything. It is available on every plan.

Requesting An Export

1. Enter your current password under Confirm with your password.
2. Click Export everything and confirm.
3. The export is built in the background. The card shows Preparing…; a large organization can take a while, and you can leave the page.
4. When it is ready you get a notification in the bell and an email. Both link to this page, not to the file.
5. Come back and click Download beside Ready.

Only one export of an organization is built at a time. If one is already being prepared, asking again tells you so instead of starting a second.

What Is In The ZIP

• data/ — one CSV per database table that holds your organization’s records, including one for your organization’s own profile. Columns use the database names, not the screen labels, and records refer to each other by id.
• files/ — every stored file: attachments, receipts, documents, photos and PDFs, filed by the table, record and field they belong to. files/index.csv maps each file to its record.
• manifest.json — every table with its row count, columns and a SHA-256 checksum, so the copy can be verified after you move it.
• README.txt — how to read the rest.

The card on the page shows how many tables, rows and files went in. If a record points at a file that could not be found in storage, the count says so and files/index.csv lists it.

What Is Left Out, And Why

Anything that would let the holder of the file act as your organization stays behind:

• Password hashes, sign-in sessions, password-reset and API tokens, passkeys and MFA secrets.
• Integration keys and secrets, incoming-webhook URLs, inbound email addresses, kiosk links and saved card authorisations.

A withheld cell reads [redacted] rather than vanishing, so you can see something was removed on purpose, and the manifest lists those columns. Tables that hold nothing but credentials and sessions are left out entirely.

Employee bank details and statutory numbers are stored encrypted and are decrypted into the export, because they are your data and are no use to another system as ciphertext. Store the file as carefully as your payroll records.

Delivery And Expiry

• Only the person who asked for an export can download it. Another administrator sees their own exports, not yours.
• The download link on the page is good for ten minutes; reload the page for a fresh one.
• The file is deleted from our servers 7 days after it is ready. The card then reads Expired and deleted.
• Requesting and downloading are both written to the audit log.