The full organisation export
Your whole workspace as a single archive: how to request one, what is inside it, and what is deliberately left out.
The register download in the previous topic is one entity as a spreadsheet. This is everything, as one archive.
How it differs from the register download
The CSV from Reports home is one entity, your individuals, in a spreadsheet. The full organisation export is your entire workspace in one archive file. Two different mechanisms for two different purposes, so never describe the CSV as an export of everything.
The register download lives in Reports. The full export lives in Backups, a separate area with its own permissions.
Requesting one
In your workspace, open Backups. If your role may download backups you will see Create backup now. The platform also takes scheduled backups on its own, so there is usually something waiting already.
Each backup row carries a Download button, which opens a short dialogue offering two choices: an encrypted archive using AES 256 with a password you choose, or a plain archive. The archive is assembled on request rather than kept ready, so there is a short wait and then it downloads.
- Manual backups are capped for each day, and only one archive is assembled at a time for a workspace.
- The password you choose is used once to write the archive and is never stored. Nobody at CommonLynk can open your encrypted archive for you, and a lost password cannot be recovered.
- Separately from that choice, everything the platform stores is encrypted where it sits, and the download is streamed out through the platform rather than handed over as a bare storage link, so it stays behind your permissions throughout.
- Every administrator on the account is notified by email when a backup is made and when one is downloaded.
What is inside
A package holds spreadsheets and CSV files, your original uploaded files, and a portable copy of the database, in folders by area:
Activities, Attachments, Attendance, Establishments, Forms, Households, Indicators, Individuals, Organisation profile and settings, Programs, Projects, Support and Users.
An assembled download stays ready for a few days, then expires, and you can build another. Backups themselves follow a schedule of recent daily, weekly and monthly copies plus a number of manual ones. When one ages out its files go, but the entry stays for your records, marked as no longer downloadable. There is no way to delete a backup yourself.
The manifest
Every package carries a manifest recording the package format version, when it was generated, the moment the data was read, your workspace name, the languages, a record count per sheet, a checksum per file, the exact software version it was built from, the database migration state, the frozen list of column headings, and what was deliberately left out.
That is what lets a package taken today still be understood and restored months from now. Column headings are never renamed or reordered once shipped, so a mapping built against one export keeps working against the next.
What is deliberately left out
Each gap below is recorded in the manifest as an exclusion rather than passed over in silence.
- Password hashes and any sign in secrets.
- API keys, encrypted credentials and tokens, which would in any case be meaningless outside the platform.
- Platform wide audit records and platform internal columns. Your own workspace activity log is included, inside the portable database copy.
- Notes visible only to support staff, and technical diagnostics. Your own support tickets, their conversations and their attachments are included.
- Rows you had already deleted.
- Indicator figures the platform calculates rather than stores, which are worked out again after a restore. The data points and targets behind them are included.
- Intermediate scoring artefacts from forms. Submitted answers, including repeat groups, are included.
- Browser session rows and cached data.
- The raw complete database dump, which would necessarily carry the sign in tables. A cleaned portable copy ships in its place: the same table structure, with credential rows and every stored password emptied, so it loads into an empty database.