Admin data export

Build a single ZIP of your organization's user data for compliance, migration, or audit.

The admin export is available from two surfaces:

• Bulk action on the Users page — select specific users with the checkboxes, then click Export data in the bulk bar.
• Organization Settings → Branding & Policy → Export organization data — covers every user in the org, with an optional date range.

Both paths require the Manage compliance permission (canManageCompliance) — the same permission that governs audit retention. They are also gated by Member chat oversight (see below).

Oversight gate

A bulk export returns full chat message content, so it rides your organization's Member chat oversight switch — the same control that governs reading member conversations.

Alert

If Member chat oversight is off, every export path returns 403 Member chat oversight must be enabled in Org Settings to export member data. Turn it on under Organization Settings → Defaults before exporting. The per-user export is gated the same way.

This is deliberate: a people-manager should not be able to exfiltrate chat history with no oversight control switched on.

What the export contains

The ZIP has one folder per user plus an organization-level manifest:

manifest.json                          ← exporter, requester, range, per-user summary, truncation notes
<email-1>/conversations.json           ← every conversation header for this user
<email-1>/messages.json                ← every message in every conversation (flat)
<email-1>/settings.json                ← the user's user_settings row
<email-1>/analytics.json               ← AI activity analytics for the range
<email-2>/…
<email-3>/…

Folder names use the user's email with characters outside A-Za-z0-9._@- replaced by _. Each messages.json entry carries:

• conversation_id, conversation_title
• message_id, role, content
• model_id, prompt_tokens, completion_tokens, total_tokens, elapsed_ms
• sql_queries (JSON, present for chat turns that ran SQL)
• metadata (JSON, free-form per-turn extras)
• created_at

If gathering a specific user's data fails mid-build, that user's folder gets an ERROR.txt and the rest of the export continues.

Running an export from the Users page

1. Open /admin/users.
2. Select rows with the checkboxes. The bulk bar appears at the bottom of the page.
3. Click Export data.
4. Confirm: "A ZIP archive with conversations, messages, settings, and analytics for each selected user will be emailed to you. The download link expires in 24 hours."

The request goes to POST /api/admin/export with { user_ids: [...] }. The server responds immediately with a confirmation, then builds the ZIP in the background and emails you a secure download link.

Cap: 200 users per export. Larger orgs must split into batches.

Running an export from Organization Settings

1. Open Organization Settings → Branding & Policy.
2. Click Export organization data….
3. Pick which users to include. Every active user is selected by default. Search by name or email, use Select all / Select none, or untick individuals.
4. Pick the time range. The selector supports:
   • All time — every conversation regardless of age.
   • Last 30 days — conversations created in the last 30 days.
   • Last 90 days — conversations created in the last 90 days.
   • Custom range — date pickers for startDate and endDate in MM/DD/YYYY format.
5. Click Request export.

When you select all active users, the request posts { all: true, range, … } and covers every user with is_active = 1. When you narrow the picker, it posts the explicit user_ids. The same 24-hour link expiry and ZIP layout applies. The chosen range is recorded in manifest.json and bounds the per-user conversations.json / messages.json. The analytics.json file reflects only the 30- and 90-day presets (as a rolling window); a Custom date range is not applied to analytics.json, which then covers all time.

Safety caps and truncation

A single runaway export can't be allowed to exhaust the worker that also serves chat, agents, and voice. The background build streams data incrementally and stops at hard caps:

Nothing is ever silently dropped. If any cap is hit, the ZIP gets a TRUNCATION_NOTICE.txt listing what was capped, manifest.json gains a truncated: true flag with a truncation block, and each affected user's manifest entry carries its own truncated reason. To capture the omitted data, re-run in smaller batches (fewer users and/or a narrower date range).

How long does it take

For most organizations, the background build finishes in under a minute. Time scales with:

• Number of users.
• Number of conversations per user (listConversations is capped at 10,000 per user).
• Number of messages per conversation.
• Range — narrower ranges build faster.

You will get the email when it is done. There is no in-app progress bar.

Email delivery

When the build finishes, Strata emails the requester a notification that the export is ready. Delivery goes through Azure Communication Services (sendTransactionalEmail), so the deployment needs AZURE_COMM_CONNECTION_STRING and AZURE_COMM_SENDER configured. The download link is a secure SAS URL that expires 24 hours after the build completes.

If you do not receive the email within five minutes:

• Check your spam folder.
• Verify your organization's email is configured (AZURE_COMM_SENDER, AZURE_COMM_CONNECTION_STRING).
• Re-run the export.

How it differs from a per-user export

Each user's manage modal has an Export all data button under Data management. It hits GET /api/admin/users/<userId>/export and returns a JSON file synchronously to your browser — no email step, no ZIP wrapper. The JSON includes the user's profile, settings, and every conversation (including user-deleted ones, flagged with deleted: true) so it carries the complete activity record. It is meant for a single individual's offboarding or a GDPR data-subject-access request for one person, and is gated by the same oversight switch and Manage compliance permission.

The bulk admin export is the right tool for organizational backups, switching platforms, or producing a multi-user discovery package.

Audit trail

Each bulk admin export emits an admin.users_exported audit event at the compliance tier. Because compliance-tier events are only persisted when the org's audit detail level is Compliance or Forensic, this record is written only on those tiers — on a Standard-tier org the event is not recorded. The event carries details:

{
  "count": 47,
  "user_ids": ["…", "…"],
  "contentDisclosed": true,
  "scope": "selected_users_full_content",
  "range": "all"
}

For an all-users export, scope is all_users_full_content. A per-user export is logged separately as user.data_exported. The exporter's email, IP, and timestamp are captured, so compliance teams can reconstruct who took what data, when, and under what oversight.

Storage and retention

The ZIP is uploaded to a private Azure Blob Storage container (data-exports) under a path like admin-exports/<orgId>/<timestamp>-strata-admin-export.zip. The download link is a SAS URL with read-only permission scoped to that exact blob and expiring in 24 hours.

After 24 hours the link is dead. If you need the export again, re-run the action to generate a fresh ZIP and signed link rather than asking support to re-issue a SAS.

What can go wrong

See Users for per-user exports, Audit log for the export trail, and Organization deletion for the recommendation to export before deleting.

Related

• Organization settings
• Roles and permissions
• Audit log
• Organization deletion