Secure Export Workflow

This page describes the hardened GDPR/export flow implemented in Veilio.

Client requests export with POST /api/compliance/export and body:
- format: json or csv
- code: TOTP code
Veilio validates session + 2FA + rate limit.
Export job is created and processed asynchronously.
User receives a download link/token (and email notification).

Before deleting an account, users must download audit logs:

http

GET /api/compliance/logs-export?startDate=YYYY-MM-DD&endDate=YYYY-MM-DD&format=json

This step is mandatory in the guided offboarding flow (/dashboard/offboarding).

See Offboarding & Account Exit for the full 5-step departure checklist (understand → export data → export logs → confirm → delete).

Secure Export Workflow

This page describes the hardened GDPR/export flow implemented in Veilio.

Security posture

Export request requires authenticated session

2FA/TOTP code is required

Export payload is encrypted at rest

Download link/token is one-time use

Token expires automatically

Full export is quota-free (all tokens detokenized regardless of plan)

Request flow

Client requests export with POST /api/compliance/export and body:

Veilio validates session + 2FA + rate limit.

Export job is created and processed asynchronously.

User receives a download link/token (and email notification).

Important hardening details

GET /api/compliance/export?code=... is disabled for security.

Export fileData is stored encrypted (enc_v1: prefix).

Download route rotates token on first successful download.

Reusing same download link returns 410 GONE.

Audit log export (offboarding)

Before deleting an account, users must download audit logs:

http

GET /api/compliance/logs-export?startDate=YYYY-MM-DD&endDate=YYYY-MM-DD&format=json

This step is mandatory in the guided offboarding flow (/dashboard/offboarding).

Guided offboarding

See Offboarding & Account Exit for the full 5-step departure checklist (understand → export data → export logs → confirm → delete).