Export all your company data

Download one ZIP of the data your organisation holds in Zonitix, for your own records, an audit, or when you leave.

For: AdministratorPlan: All plans

Before you start

The administrator role. This cannot be granted as a single permission; nobody else sees “Data export”.
Your password or second factor to hand. Starting an export and downloading it each ask you to re-authenticate.
Somewhere safe to keep the file. It contains personal data about employees and candidates.

Build the export

Step 1: Open Data export
Go to Security & ComplianceSecurity SettingsData export. It is in the “Data” group of the Security Settings menu.
Step 2: Start it
Click “START FULL EXPORT”, then “Start export” in the “Export all company data?” window, and re-authenticate when asked.
You see “Export started. You can leave this page — it keeps running on the server.” Only one export runs at a time, and you can start up to 3 in 24 hours.
Step 3: Download it
When the export is ready it appears under “Recent exports” with a “DOWNLOAD ZIP” button. Click it and re-authenticate. The download link works once and lasts 15 minutes; click the button again if you need another.
The file is deleted from the server 24 hours after it is ready. Download it before then, or start a new export.
Step 4: Look inside
Inside the ZIP, README.txt explains the layout and manifest.json lists every file with its own row count and SHA-256 (a long code worked out from the file; if the file changes, the code changes).

Check the download is complete (optional)

Step 5: Know what the check proves
The card shows a “ZIP SHA-256”: a long code of letters and digits worked out from the file, a kind of fingerprint. If your computer works out the same code from the file you downloaded, the file is complete and was not changed on the way. The export is usable without this check. Do it when the file is going to an auditor or into long-term storage.
The check means typing one command. If you would rather not, ask whoever helps you with IT to do steps 6 and 7 with you, on the computer that holds the ZIP. Do not email the ZIP to them: it contains personal data.
Step 6: Work out the code on your computer
On a Mac: press Cmd+Space, type Terminal and press Return. In the window that opens, type shasum -a 256 and a space, drag the ZIP from Finder into the window, and press Return. If you find a folder and no ZIP, your browser unpacked the file after downloading it (this is general computer guidance, not something Zonitix controls): look for the ZIP in the Trash, or click “DOWNLOAD ZIP” again in a browser that keeps the file.
On Windows: open the Start menu, type PowerShell and press Enter. In the window that opens, type Get-FileHash and a space, drag the ZIP from File Explorer into the window, and press Enter. The code is printed under Hash.
Either way it can take a minute on a large file. Nothing is changed or sent anywhere; the command only reads the file.
Step 7: Compare the two codes
Compare the code in the window with the “ZIP SHA-256” on the card, from the first character to the last. Capital and small letters do not matter (Windows prints capitals). An easy way is to paste both into an empty text document, one under the other.
If they are the same, the file is good. If they differ anywhere, the download was cut short or damaged: see the troubleshooting list below.

What is in the ZIP. Every dataset as both JSON and CSV:

Identity and access: people, groups, roles and permissions, personas, access requests and access reviews.
Workflows: workflows and their runs.
Audit: the audit log.
Compliance: audit runs and evidence records, control states, assignments, remediations, assessments, policy versions and signatures, recorded exemptions and the list of saved report runs.
HR records: employee profiles, employment events, compensation history, emergency contacts, time off (leave types, requests and balances), holiday calendars, departures, employee documents, goals and example goals, review cycles, reviews and feedback, training (courses, assignments, completions, learning paths, the list of uploaded files) and surveys with their invites and responses.
Hiring: job postings, candidates, interviews, offers, notes, messages, stage history and referrals.
Signatures, finance and devices: signing templates, submissions, signers and events; finance document records; the device inventory.

Files are included too: uploaded compliance evidence, saved report PDFs and CSVs, candidate résumés, employee documents, and signed PDFs with their certificates of completion.

Fields that Zonitix stores encrypted, such as a candidate’s phone number, are written to the export in readable form. That is one more reason to keep the file somewhere safe.

What is left out on purpose. Passwords, MFA secrets and recovery codes, sign-in and signing tokens, credentials for connected systems, SCIM tokens, passkey credentials, and disk-encryption recovery keys and other key material. Two kinds of file content are also left out, with only their records exported: the text and source files of finance documents, and uploaded training videos and course packages (you still hold the originals). The manifest lists these exclusions. This export is not a database backup and cannot be restored into an instance; for that, see Set up backups.

What you should see

A ZIP on your computer. If you ran the optional check, its SHA-256 matches the one on the card. The request and every download are recorded in the audit log.

If something goes wrong

Data export is not in the Security Settings menu.: Only the administrator role sees it. Ask an administrator to run the export.
The button reads "EXPORT IN PROGRESS…" and cannot be clicked.: An export is already being built. Wait for it to appear under Recent exports.
A warning says some items could not be exported.: Open manifest.json in the ZIP and read "notes": it lists exactly what was skipped and why. A file is skipped when the service that stores it was not running, for example a module your plan does not include.
The code your computer worked out does not match the ZIP SHA-256 on the card.: First make sure you checked the file from this export and not an older one. Then click “DOWNLOAD ZIP” again and repeat the check on the new file. If it still differs, start a new export, and if that one differs too, contact Zonitix support.
"The export failed.": Start it again. If it fails a second time, contact Zonitix support.
The export says the encrypted file was deleted from the server.: It passed the 24-hour limit. Start a new export.