Operators handbook: website export

When a client leaves for another provider, they take their website with them: a website export is one zip with a static copy of the site, the theme source and their data as CSV, ready to hand over.

It is not a backup. A backup (Backups) is a database dump for restoring into CeeMS and is useless anywhere else. An export is meant to be read without CeeMS: by the client, by their next web builder, by another shop platform's importer.

Who can make one, and who can download it

Only super admins make or delete an export. An export is every customer's personal data in one file, going outside the platform; that is the platform operator's decision, not a website admin's.

The website's own admins see the list and download a finished export (on the website's Backups tab), so the client can collect the package made for them. Editors see nothing of it. Whether someone may download is checked again when the link is followed: an admin who lost the role or the website in the meantime gets a 404.

Start it from the website in the admin. The worker builds it in the background (minutes for a large shop, like a backup), and the export list shows it as queued, running, then done or failed. Only one export of a website runs at a time: starting a second while one is queued or running is refused.

Downloading it

Download on a finished export saves the zip straight to your computer, like any other file download, so an export of several gigabytes is no problem. Behind the button the admin asks for a link to that one export that works for five minutes, and the browser follows it at once. The link is yours alone and expires within minutes: it is not something to pass on. Each click makes a new one.

What is in the package

One zip, named <websitecode>-export-<date>.zip on download:

Path	What it is
`README.txt`	What the package holds, how to use it, and notes on this export, in English and Dutch. Read it before handing the zip over: it says what is missing, if anything.
`site/`	A static copy of the public website: every page as an anonymous visitor saw it, as HTML with its images, styles and scripts, links rewritten so it opens anywhere.
`theme/`	The active theme version as deployed (Twig templates, styles, assets), for reference. It needs CeeMS to render. Dotfiles and version-control folders are left out.
`data/customers.csv`	Customer accounts. No passwords. Accounts an admin deleted are left out.
`data/customer_addresses.csv`	Their address books, linked to the customer by email.
`data/orders.csv`	One row per order, every status: number, date, status, email, totals, VAT (with the split per rate), discount, gift card amount, shipping method, payment method, delivery moment, shipping and billing address.
`data/order_items.csv`	One row per order line, linked by `order_id`.
`data/newsletter_subscribers.csv`	Every address with its status, unsubscribed ones included, so the next provider does not mail them.
`data/form_submissions.csv`	Form submissions: form, date, status, subject, the fields as JSON, and the attachments. Spam the site rejected is left out.
`data/form-attachments/`	The files sent with those submissions (files already removed by the retention policy are listed, not included).
`data/products.csv`	The catalog in Shopify's product CSV format, which Shopify, WooCommerce and most other platforms import. Prices include VAT.
`data/product-images/`	The original product images. `Image Src` and `Variant Image` in `products.csv` point here; they have to be uploaded somewhere and the paths replaced by URLs before an import.

All CSV files are UTF-8 (no BOM), comma separated, with a header row. Amounts are decimals (12.50), dates ISO 8601 with time zone.

products.csv, in short

One product spans several rows with the same Handle: the first row carries the product, the next rows a variant and/or an image each.
Only variants that are on sale are exported (Shopify has no hidden variant). Variant Barcode is the variant's own GTIN; a product without variants uses the product's.
Vendor is the brand, Type the first category, Tags the tags plus every category name (collections can be rebuilt from them).
Shopify allows three options per product; a fourth is left out and the README says for which products.
Translations are not in this file; the default language is. The static copy in site/ has every language.

What is deliberately left out

Password hashes, password reset and email verification tokens, newsletter confirm and unsubscribe tokens.
Gift card codes (bearer secrets; orders keep only the amount paid by card), payment gateway credentials, API keys, and the gateway's checkout links.
Internal notes on orders, analytics signals, IP addresses and spam scoring of form submissions.
Other websites' data: every query is scoped to the website.

What does not work in the static copy

The static copy is HTML files only. Everything that needed CeeMS on the server stops working there:

forms (contact, quote, newsletter sign-up) send nothing;
the cart and the checkout: nothing can be ordered or paid;
customer accounts: logging in, order history, password reset;
search.

The pages still show them; the buttons just do nothing useful. The new provider rebuilds these with the data in data/.

When something fails

The parts of an export are built independently. If the static copy fails (for instance because the site cannot be reached), the export still finishes with the theme and all the data, and shows a warning; the README says what is missing and why. Only when every part fails is the export marked failed.

How long it is kept

Seven days after it finished. A nightly sweep then deletes the zip and the export row, so an export does not linger as a copy of everyone's personal data. A failed export goes the same way after seven days. An export that has been queued or running for more than a day is marked failed by the same sweep.

You can delete an export earlier yourself, also one that is still being built. Requests and downloads are logged with the admin who made them.

The sweep runs as the exports:prune task of the worker schedule.

Handing it over

data/ is personal data of the client's customers. The client is the controller (verwerkingsverantwoordelijke) under the GDPR; the README tells them so. Download it and send the file in a way you would send any personal data, not as a mail attachment, and delete your own copy once it has been handed over.