Tenant export and restore
Use Data Exports when you need a portable tenant package, recurring export delivery, or a controlled restore from a previous TvRMM export.
The customer-facing portal path is Administration → Tenant Settings → Data Exports. The deployed route is /ui/tenant/exports.
The final restore commit atomically replaces the tenant's current portable data with the validated package. Create and retain a pre-restore export, review validation results, resolve required mappings, and confirm the tenant slug before applying a restore.
Roles and effective role
TvRMM evaluates the user's effective tenant role, including any operating-as cap.
- Tenant admin or tenant owner: create redacted exports, review export activity, connect Google Drive, choose a Drive folder, manage reusable destinations, and configure redacted recurring schedules.
- Tenant owner: create encrypted full exports, configure full-package recurring schedules, upload or select restore packages, resolve restore mappings, create the mandatory safety export, and commit the final restore.
- Operator and viewer: use normal role-scoped product workflows. Export, destination, schedule, and restore controls are not standard operator or viewer actions.
If a control is missing, confirm the selected tenant, assigned role, and operating-as role before escalating.
Package modes
TvRMM creates portable .tvrmm-export packages.
| Mode | Who can create it | Customer-facing behavior |
|---|---|---|
| Redacted package | Tenant admin or tenant owner | Includes portable tenant data with explicit markers where secret values are omitted. A later restore may require owner-provided mappings for those redacted values. |
| Encrypted full package | Tenant owner | Includes customer-defined secret variables and requires a package password. Use this mode for full tenant portability and pre-restore safety exports. |
Completed packages remain available from TvRMM for 72 hours. After the server copy expires, use a retained local download or a delivered Google Drive copy.
Manual export
- Open Administration → Tenant Settings → Data Exports.
- In Create export, choose Create redacted export or Create encrypted export.
- For an encrypted full package, enter a new package password and store it outside TvRMM.
- Watch Export activity for status and progress. Jobs move through queued/running states and finish as completed, failed, cancelled, or unavailable.
- When the package is completed, use Deliver to download it to the current device or send it to an available Google Drive destination.
Export activity shows the package filename, size, checksum evidence where available, expiry time, progress, safe failure reason, and delivery history.
Google Drive destinations
Google Drive delivery is the managed delivery path for exports that need to leave TvRMM automatically or after manual completion.
- In Destinations, select Connect Google Drive.
- Complete the Google authorization flow.
- Choose the Drive folder that will receive export packages.
- Review the destination card. TvRMM labels these as private
drive.fileconnections.
TvRMM uses the Google Drive drive.file scope for this workflow. The connection is scoped to files and folders selected through the connected account, not broad Drive browsing. Disconnecting a destination stops future TvRMM delivery through that connection; existing files in Google Drive remain in the customer's Drive unless the customer removes them there.
Google Drive export delivery requires encrypted packages. Keep the package password separate from the Drive account and share it only through your normal secure customer process.
Recurring schedules
Recurring schedules create export packages and deliver them to configured destinations.
- Connect at least one Google Drive destination.
- In Scheduled exports, choose the package mode, cadence, time zone, local time, and destination.
- Enter the recurring package password.
- Save the schedule.
Supported cadence options are hourly, daily, weekly, and monthly where the portal exposes the matching fields. Schedule cards show mode, cadence, destination status, retained Drive file count, server copy retention, next run, last run, recent delivery runs, and recent export runs.
Tenant admins can manage redacted recurring schedules. Tenant owners are required for encrypted full-package schedules. Every completed scheduled package keeps the TvRMM server copy for 72 hours, and the Drive retention setting controls how many delivered Drive files TvRMM keeps for that destination.
Use Run now to start an enabled schedule outside its normal cadence. Use pause, resume, update, or delete when a destination changes, a password must rotate, or a schedule is no longer needed. Updates and deletion are blocked while an export or delivery is active.
Delivery history and errors
Delivery history records each destination attempt and its status. Typical recovery actions are:
- reconnect Google Drive when the account or folder is unavailable;
- choose a new Drive folder when the selected folder was removed or access changed;
- create a new encrypted package when the completed server copy expired;
- reduce package scope only by using the available package modes and destinations, not by editing package contents manually;
- contact support when a safe failure message does not identify a customer action.
Export by email is not supported. Tenant export packages are too large for email to be a viable delivery channel. Ordinary product email, such as account or support email, is unrelated to tenant export delivery.
Agent-based export delivery is retired. Use download, Google Drive destinations, schedules, and delivery history instead.
Restore sources
Tenant restore accepts portable .tvrmm-export packages from:
- This device: choose a local package and upload it in the portal.
- Google Drive: choose a package from a connected Drive folder.
Only tenant owners can start restore jobs. The package must be a TvRMM tenant export package. Encrypted packages require the package password. Redacted packages may require owner decisions for omitted values before validation can complete.
Restore flow
- Open Administration → Tenant Settings → Data Exports.
- In Restore tenant data, choose This device or an available Google Drive source.
- Select a
.tvrmm-exportpackage. - Enter the package password if you have it. If not, upload first and enter it when TvRMM asks.
- Select Upload and validate.
- Review validation progress and any safe errors.
- If TvRMM asks for redacted-value handling, choose whether to reuse a compatible current value, enter a replacement, or leave the value null. Download the missing-value checklist when you need an offline review.
- When validation is ready, create the mandatory pre-import safety export with a new safety-export password.
- Review the final state and confirmation prompt.
- Type the required confirmation and select Commit restored tenant only when you are ready to replace current portable tenant data.
You can cancel a restore before the final apply step. Cancellation before apply leaves the current tenant state active.
Expected results
Before final apply, uploaded restore data is staged separately and the existing tenant remains active. If validation fails, the prior tenant state remains active and TvRMM shows a safe error. Upload a corrected package or contact support with the visible job status.
During final apply, TvRMM exposes either the complete old state or the complete restored state. After a successful commit, the imported tenant state is active and restore evidence remains visible. Endpoints absent from the package retain only their secure identity and return as new endpoints on their next authenticated heartbeat.
After commit, do not treat restore as a partial undo tool. Use the mandatory safety export or another retained export package if you need to restore again. Escalate to support when validation errors, missing-value mappings, Drive access, or post-restore endpoint behavior do not match the visible status.