Data Export & Retention
CVD Portal has these ways to export your data.
| Export | How | Plan | Format |
|---|---|---|---|
| Whole workspace (users, reports, products, SBOMs, evidence metadata, settings, audit log and more) | Settings → Account → Export your data. Admins only | All plans, including Free | HTML, CSV or JSON |
| All company data (users, reports, webhooks, API key metadata, audit log) | GET /api/v1/gdpr/export with an API key that has the gdpr:export scope | Enterprise | JSON |
| Vulnerability reports, up to 100 for each request | GET /api/v1/vulnerabilities/export with the read scope | Enterprise | JSON |
| Auditor evidence package | Dashboard. See How do I export an auditor evidence package? | See the linked page | See the linked page |
| CSAF advisory for a report | Report page. See CSAF Advisory Export | Reporting | CSAF JSON |
The full data export includes up to 10,000 audit log entries. It removes the IP address from audit entries older than 90 days. You can run it 5 times each hour.
Retention
You cannot set retention or deletion rules for your data. CVD Portal does not automatically redact or delete report details.
CVD Portal never deletes audit entries for CRA Article 14 actions. The privacy policy states that operational audit entries, for example logins and page views, are kept for 12 months.