Exporting and retrieving your data

Your data belongs to you. The owner and the admins of an organization can export all of it, at any time, self-service: projects, stack, machines and inventories, alerts, cases and their history, exceptions, reports, workflows, settings, members, audit log. The export is free, on every plan, Free included, and no exit fee is ever charged.

• Who: Owner and Admin of the organization.
• Where: Organization settings › Organization › Data. The same button is offered before deleting the organization.

Export all the data

1. Open Organization settings › Data.
2. Click Export all data.
3. The export is prepared in the background: you can close the page. Its row shows Preparing, then Ready.
4. An email is sent to you with a download link. The link works without signing in and stays valid for 7 days; the Data page also offers Download while it is valid.

Caution

The link in the email gives access to all the organization’s data, without a password: only share it with people you trust. After 7 days, the archive is erased; start a new export.

Only one export is prepared at a time per organization, and at most five exports can be requested per 24 hours. This safeguard protects the service; it costs nothing and does not depend on the plan.

Every request, every availability and every download is recorded in the organization’s audit log (actions org.export_complet.demande, .pret, .telecharge). The Data page also keeps the list of the latest exports: date, size, row count, SHA-256 digest, downloads.

What the archive contains

The archive is a ZIP file. The formats are open and documented:

File	Format
donnees/<dataset>.json	One table per file, as JSON (RFC 8259), UTF-8: an array of objects, one key per field. ISO 8601 UTC dates, UUIDs as text, missing values as null. Values are exact.
csv/<dataset>.csv	The same table as CSV (RFC 4180), UTF-8 with BOM, for spreadsheets. A cell that would start with =, +, - or @ is prefixed with an apostrophe (formula-injection protection): the JSON is authoritative.
schemas/<dataset>.schema.json	The JSON Schema (draft 2020-12) of each JSON file.
sbom/<project>.cdx.json	Each project’s stack as CycloneDX 1.5, importable into any compatible tool.
manifest.json	Format version, date, row count of each dataset, SHA-256 digest of each file, data not exported and why.
LISEZMOI.txt	How to read the archive (French and English).

The archive is a consistent snapshot: all tables are read at the same instant.

Secrets are never exported: passwords, API keys, tokens, webhook and connector secrets, and webhook URLs (they act as keys at Slack or Teams). They are means of access: recreate them with the new provider.

Switching providers

You can leave TechWatchAlert for another service, or for your own tools, whenever you want:

• no fee for switching, leaving or exporting;
• you can start the switch at any time, with at most two months’ notice;
• during a transition period of at most 30 days, the service and the export remain available, and support helps you (support@techwatchalert.com);
• your data then remains retrievable for at least 30 days; after a confirmed deletion, the person who confirmed it can still export the organization from Data until it is permanently erased;
• after that period, the data is erased (see Deleting the organization).

The applicable terms are those of the terms of use (article 22).

Format register

This register describes each dataset of the archive and its fields. It is also published as JSON, for tools: formats-export.json, and served by the API at https://app.techwatchalert.com/api/donnees/formats-export (no key).

Organization, members and access

Dataset	Content	Fields
organisation	The organization: name, plan, prioritization and remediation policies, compliance settings, branding.	id, name, created_by, is_personal, plan_id, paddle_customer_id, paddle_subscription_id, paddle_evenement_le, trial_ends_at, essai_offre, essai_commence_le, essai_rappel_le, essai_fin_notifiee_le, essai_domaine, machines_supp, options_offre, offre_transition, politique_priorisation, politique_remediation, reglages_conformite, marque, partenaire_id, partenaire, offre_partenaire, suppression_prevue_le, fuseau, langue, created_at
membres	Organization members, role, job title, access expiry.	id, org_id, user_id, role, joined_at, job_title, note, expires_at, fonctions_conformite, delegue_par, temporaire, rappels_echeance, email, nom_complet
invitations	Invitations sent (without their token).	id, type, target_id, inviter_id, invitee_email, role, group_id, assignation_projet_id, assignation_role, assignation_cves, acces_jours, status, expires_at, created_at
groupes	Groups, default roles and permissions.	id, org_id, name, description, default_org_role, default_project_role, project_access, custom_permissions, is_system, partenaire_id, created_by, created_at
groupes_membres	Group memberships.	id, group_id, user_id, added_at
groupes_projets	Projects granted to each group, with the role.	id, group_id, project_id, role
etiquettes	Organization tags.	id, org_id, name, color, created_by, created_at
sso	Single sign-on configuration (without the client secret).	id, org_id, is_enabled, protocol, fournisseur, oidc_issuer, oidc_client_id, email_claim, name_claim, default_group_id, auto_provision, enforce_sso, saml_idp_entity_id, saml_idp_sso_url, saml_idp_certs, saml_idp_metadata_url, saml_idp_metadata_at, saml_sp_cert, saml_nameid_format, saml_attr_email, saml_attr_prenom, saml_attr_nom, saml_attr_groupes, saml_idp_initiated, created_at, updated_at
domaines_email	Declared email domains and their verification.	id, org_id, domain, verified_at, created_at
sso_identites	Persistent SAML identifiers linked to accounts.	id, org_id, sujet, user_id, created_at
correspondances_groupes	Directory groups mapped to organization groups.	id, org_id, groupe_idp, group_id, created_at
scim	SCIM provisioning: token prefix and dates (never the token).	id, org_id, jeton_prefixe, jeton_cree_le, jeton_cree_par, derniere_utilisation, created_at
scim_utilisateurs	Accounts provisioned by the directory (SCIM) and their state.	id, org_id, user_id, user_name, external_id, email, prenom, nom, nom_affiche, active, created_at, updated_at
scim_groupes	Groups pushed by the directory (SCIM).	id, org_id, nom_affiche, external_id, created_at, updated_at
scim_membres	SCIM group members.	groupe_id, scim_utilisateur_id
cles_api	API keys: name, prefix, scopes, expiry (never the key itself).	id, org_id, created_by, name, key_prefix, expires_at, scopes, project_ids, last_used_at, created_at, is_active
applications_autorisees	Applications authorized through the MCP connector.	id, user_id, org_id, client_id, client_hote, client_nom, redirect_hote, scopes, created_at, derniere_utilisation, revoquee_le, revoquee_par
consommation_ia	Monthly AI feature usage.	id, period, org_id, tokens, updated_at
activations_conformite	Compliance frameworks enabled, by whom and when.	id, cadre, project_id, org_id, actif, active_le, active_par, desactive_le, desactive_par
demandes_partenaire	Partner programme application.	id, statut, societe, nom, email, telephone, site, pays, clients, message, langue, ip, traitee_par, traitee_le, motif_refus, note, org_id, activer_hors_paddle, created_at
mode_observation	Observation mode: on or off, since when, who changed it.	org_id, actif, depuis, quitte_le, quitte_par
domaines_adhesion	Domains open to join requests.	id, org_id, domaine, ajoute_par, created_at
demandes_adhesion	Join requests received and their decision.	id, org_id, user_id, statut, created_at, decidee_le, decidee_par
demandes_offre	“Ask my admin” requests: plan or feature requested, cost shown, decision.	id, org_id, demande_par, offre_visee, machines, fonction, limite, compteur, motif, cout, statut, cree_le, traite_le, traite_par, traite_via, note
vues_enregistrees	Saved list views (filters, sort, columns, project), personal or shared.	id, org_id, user_id, contexte, nom, parametres, requete, partagee, ordre, created_at, updated_at
abonnements_vues	View subscriptions: channel, frequency, items seen at the last check.	id, vue_id, user_id, canal, webhook_id, frequence, heure, jour, fuseau, actif, elements_vus, prochain_passage_le, dernier_passage_le, dernier_envoi_le, created_at
donnees_facturation	Billing details: company name, address, VAT, SIREN, billing contacts and emails.	org_id, raison_sociale, pays, adresse_ligne1, adresse_ligne2, code_postal, ville, region, numero_tva, tva_statut, tva_verifiee_le, tva_nom_vies, siren, emails_facturation, contact_nom, contact_email, reference_bon_commande, maj_le, maj_par
etat_facturation	Subscription status: cycle, next invoice, failed payment and grace period, scheduled plan change.	org_id, echec_depuis, grace_jusqu_au, bascule_free_le, plan_avant_bascule, dernier_paiement_le, statut_abonnement, cycle, prochaine_facture_le, moyen_paiement, changement_prevu, maj_le
acces_delegues	Your provider’s delegated access (GDAP-style): role, expiry, revocation.	id, org_id, partenaire_id, role, statut, accorde_par, accorde_le, expire_le, revoque_par, revoque_le, rappels, modifie_le
releves_usage_msp	Monthly machine statements (partner): billable machines per client, tiers, amount.	id, org_id, mois, machines_facturables, machines_grace, machines_nfr, clients, montant_brut_ht, remise_pct, montant_ht, devise, lignes, par_client, conditions, statut, erreur, calcule_le, facture_le
certifications_partenaire	Your team’s partner certification: attempts, score, pass and expiry (never the answers).	id, org_id, user_id, version, score, total, reussie, passee_le, expire_le

Projects, stack and connectors

Dataset	Content	Fields
projets	Projects: description, criticality, own policies.	id, name, description, owner_user_id, org_id, is_default, politique_priorisation, politique_remediation, avertissement_seuils_masque, criticite, exposition, workflows_amorces, eol_notify_before_eol_days, eol_notify_before_support_days, webhooks_enabled, created_at
projets_membres	Per-project access of each person.	id, project_id, user_id, role, custom_permissions, added_by, granted_by_group_id, added_at
projets_etiquettes	Project tags.	id, project_id, tag_id, created_by, created_at
projets_notifications	Notification preferences per project and person.	id, project_id, user_id, mode, mode_cloche, mode_email, email_enabled, in_app_enabled, created_at, updated_at
webhooks	Project webhooks (name, kind, state; the URL and secret, which are credentials, are excluded).	id, project_id, name, is_enabled, kind, filtres, a_verifier, created_by, created_at, updated_at
stacks	Project stacks.	id, user_id, project_id, name, created_at
composants	Monitored components: product, vendor, version, CPE, purl, origin, criticality.	id, watchlist_id, item_type, value, version, match_state, cve_link_count, dernier_match_job_id, origine, toutes_versions_heritee, vendor, cpe, purl, min_severity, criticite, exposition, connecteur_id, sbom_application_id, source_chemin
composants_etiquettes	Component tags.	id, item_id, tag_id, created_by, created_at
composants_provenances	Where each component comes from (file, connector, SBOM).	id, item_id, origine, source_cle, chemin, libelle
composants_cve	CVEs linked to each component.	item_id, cve_id, project_id, cree_le
composants_vulnerabilites	Security advisories (OSV, GHSA) affecting each component.	id, watchlist_item_id, vulnerability_id, motif
applications_sbom	SBOM-fed applications.	id, project_id, nom, created_at, dernier_push_le
envois_sbom	SBOM upload history.	id, application_id, org_id, recu_le, composants, source
scans	Imported scan reports.	id, project_id, outil, cible, fichier, via, importe_par, importe_le, nb_constats, nb_hors_cve, connecteur_id, partiel, empreinte, confirme_le
scans_constats	Findings of each scan report.	id, scan_id, cve_id, composant, version, version_corrigee, severite, actif, actif_nom, systeme, port, reference, titre, preuves, machine_id
urls_surveillees	Monitored URLs and their certificate.	id, project_id, url, label, is_enabled, scan_interval_hours, last_scanned_at, next_scan_at, last_status, last_error, last_http_status, cert_expires_at, cert_issuer, auto_watch_enabled, auto_watch_user_id, created_by, created_at, updated_at
urls_detections	Technologies detected at each URL scan.	id, monitored_url_id, scanned_at, http_status, response_time_ms, technologies, raw_headers, error_message
fin_de_vie_suivis	End-of-life tracking: owner, planned exit, notes.	id, project_id, produit, cycle, sortie_prevue, porteur_id, note, maj_par, maj_le, annonces, created_at
fin_de_vie_abonnements	Product end-of-life subscriptions.	id, project_id, created_by, product_id, cycle, notify_before_eol_days, notify_before_support_days, known_cycles, eol_notified_at, support_notified_at, eol_notified_ref, support_notified_ref, created_at
connecteurs_inventaire	Inventory connectors (configuration without secrets).	id, project_id, type, config, actif, derniere_synchro_le, derniere_reussie_le, dernier_resultat, derniere_erreur, cree_par, cree_le
passages_connecteurs	Connector and repository synchronization history (90 days): trigger, result, changes.	id, project_id, famille, connecteur_type, source_cle, source_nom, declencheur, auteur_id, debut, fin, statut, ajoutes, mis_a_jour, retires, raison, message, changements
github_installations	GitHub installations.	id, project_id, installation_id, compte, type_compte, repository_selection, suspendue, liste_incomplete, cree_par, created_at
github_depots	Monitored GitHub repositories.	id, installation_ref, repo_id, nom_complet, branche_defaut, prive, active, autorise_par, retire, sbom_application_id, a_synchroniser, dernier_sha, derniere_synchro_le, fichiers, composants, lecture_incomplete, natures, vendors, derniere_erreur, jeton_expire, echecs_consecutifs, prochain_essai_le, created_at
gitlab_connexions	GitLab connections (without tokens).	id, project_id, instance_url, gitlab_user_id, compte, client_id, suspendue, liste_incomplete, cree_par, created_at
gitlab_depots	Monitored GitLab projects.	id, connexion_ref, projet_gitlab_id, nom_complet, branche_defaut, prive, active, autorise_par, retire, sbom_application_id, a_synchroniser, dernier_sha, derniere_synchro_le, fichiers, composants, lecture_incomplete, natures, vendors, derniere_erreur, jeton_expire, echecs_consecutifs, prochain_essai_le, created_at
conteneurs_registres	Container registries (without secrets).	id, project_id, hote, identifiant, cree_par, created_at
conteneurs_clusters	Declared Kubernetes clusters.	id, project_id, nom, jeton_debut, dernier_envoi_le, images_vues, liste_incomplete, cree_par, created_at
conteneurs_images	Monitored container images.	id, project_id, reference, ajout, cluster_id, espaces, vue_le, active, autorise_par, retire, sbom_application_id, a_synchroniser, dernier_digest, systeme, paquets, composants, lecture_incomplete, derniere_synchro_le, derniere_erreur, jeton_expire, echecs_consecutifs, prochain_essai_le, created_at
integrations_tickets	Ticket integrations (Jira, GitLab, GitHub, GLPI, ServiceNow; without tokens or the webhook address).	id, project_id, fournisseur, url_base, cible, identifiant, options, actif, nom, par_defaut, webhook_recu_le, dernier_succes_le, derniere_erreur, derniere_erreur_le, cree_par, cree_le, modifie_le
tickets_lies	Tickets created or linked from cases, with their status in the tool.	id, project_id, cve_id, integration_id, fournisseur, cle, url, origine, cree_par, cree_le, id_distant, statut_distant, statut_brut, statut_distant_le, synchro_le, synchro_erreur, retour_le, retour_etat
autorisations_relais	On-site collection: targets authorised to agents for connectors, and their withdrawal.	id, project_id, connecteur_id, connecteur_type, agent_id, tache_id, schema, hote, port, empreinte_certificat, base_dn, expire_le, motif, cree_par, cree_le, revoquee_le, revocation_tache_id
premieres_synchros	First synchronization of each source per project (summary sent instead of a burst).	project_id, source, le, composants, cves, exploitees
integrations_psa	Partner PSA tool (ConnectWise, Autotask, HaloPSA; without credentials).	id, org_id, fournisseur, url_base, options, actif, dernier_succes_le, derniere_erreur, derniere_erreur_le, passage_le, cree_par, cree_le
psa_correspondances	Mapping between clients and PSA companies.	id, org_id, integration_id, client_id, company_id, company_nom, modifie_le
tickets_psa	Tickets opened in your provider’s PSA tool for your alerts.	id, org_id, project_id, cve_id, integration_id, fournisseur, cle, url, origine, cree_par, cree_le, id_distant, statut_distant, statut_brut, statut_distant_le, synchro_le, synchro_erreur, retour_le, retour_etat
integrations_rmm	Partner RMM accounts read by API (NinjaOne, Datto RMM, N-central, Atera; without secrets).	id, org_id, fournisseur, config, actif, dernier_succes_le, derniere_erreur, cree_par, cree_le, modifie_le
remontees_rmm	Last risk value written to the RMM for each device.	connecteur_id, identifiant, valeur, ecrite_le

Fleet: machines, agents and inventories

Dataset	Content	Fields
machines	Machines: system, hardware, network, criticality, owner.	id, project_id, nom, fqdn, famille_os, os_nom, os_version, os_build, systeme, noyau, architecture, fabricant, modele, numero_serie, processeur, memoire_mo, virtuelle, adresses_ip, adresses_mac, dernier_utilisateur, premiere_vue_le, derniere_vue_le, demarree_le, redemarrage_requis, criticite, environnement, proprietaire, emplacement, etiquettes, exposition, notes, cree_le, modifie_le
machines_sources	Sources that saw each machine (agent, connector, scan).	id, machine_id, origine, outil, source_cle, identifiant, premiere_vue_le, derniere_vue_le, dernier_contact_le, presente, attributs, identifiants
machines_logiciels	Software inventory of each machine.	id, machine_id, source_cle, nom, version, editeur, format, item_id, premiere_vue_le
machines_evenements	Events of each machine.	id, machine_id, type, detail, le
machines_expositions	History of each CVE on each machine: detected, fixed, back.	project_id, cve_id, machine_id, logiciels, detectee_le, vue_exposee_le, corrigee_le, correction, reapparue_le, reapparitions
surface_domaines	Domains whose external surface is monitored.	id, project_id, domaine, label, is_enabled, scan_interval_hours, verifie, jeton_verif, verifie_le, attestation_version, attestation_le, attestation_par, attestation_ip, derniere_relance_le, relances_jour, relances_nb, last_scanned_at, next_scan_at, last_status, last_error, created_by, created_at, updated_at
surface_actifs	Discovered subdomains, IPs and exposed services.	id, project_id, domaine_id, type, valeur, source, details, present, absences, premiere_vue_le, derniere_vue_le
surface_constats	External surface findings (ports, certificates, SPF/DMARC).	id, project_id, domaine_id, type, cible, gravite, details, ouvert, absences, premiere_vue_le, derniere_vue_le, resolu_le
surface_domaines_retires	Domains removed from the external surface (counted in the quota for 30 days).	id, org_id, project_id, domaine, retire_le
machines_mises_a_jour	Available or installed updates.	id, project_id, machine_id, cle, source, identifiant, titre, categorie, severite, kb, paquet, version_installee, version_disponible, taille_octets, redemarrage_requis, publie_le, cves, premiere_vue_le, derniere_vue_le, echec, echec_le
groupes_machines	Machine groups and their rules.	id, project_id, nom, description, type, regles, cree_le
groupes_machines_membres	Machines in each group.	groupe_id, machine_id
agents	Enrolled agents (without their secret).	id, project_id, machine_id, identifiant_materiel, jeton_id, version, plateforme, enrole_le, dernier_contact_le, ip_contact, revoque_le, empreinte_inventaire, inventaire_le, mises_a_jour_le, erreurs_scan, sources_scan, relais_autorise, hors_ligne, cle_hors_ligne, sequence_hors_ligne, collecte_le, dernier_import_le
jetons_enrolement	Enrollment tokens: name, prefix, usage (never the token).	id, project_id, nom, prefixe, cree_par, cree_le, expire_le, utilisations_max, utilisations, revoque_le, groupe_id, etiquettes, dernier_usage_le
parametres_parc	Fleet management settings.	project_id, scripts_autorises, intervalle_contact_s, maj_agent_auto, modifie_par, modifie_le
politiques_mises_a_jour	Update policies.	id, project_id, nom, description, active, toutes_machines, groupes, criteres, planification, fenetre_minutes, redemarrage, anneau_precedent_id, validation_jours, derniere_execution_le, prochaine_execution_le, cree_par, cree_le, modifie_le
politiques_executions	Update policy runs.	id, project_id, politique_id, declenchement, libelle, cree_par, cree_le, fenetre_fin_le, bilan
approbations_mises_a_jour	Update approvals and refusals.	id, project_id, cle, decision, note, par, le
scripts_parc	Fleet scripts.	id, project_id, nom, description, interpreteur, contenu, delai_max_s, cree_par, cree_le, modifie_le
taches_agents	Tasks sent to agents and their result.	id, project_id, machine_id, agent_id, type, parametres, statut, cree_par, execution_id, script_id, pas_avant_le, expire_le, cree_le, envoyee_le, debut_le, fin_le, code_sortie, sortie, erreur, details
imports_hors_ligne	Offline machines: imported collection files and what happened to each collection.	id, project_id, recu_le, par, via, fichier, taille, type, importees, refusees, details
remediations_ia	AI-assisted remediations: proposed commands, verdicts, fixes and tasks sent.	id, project_id, cve_id, cve_ids, statut, machines, verification, taches_verification, analyse, correction, taches_correction, suivi, jetons, cree_par, cree_le, modifie_le
ecarts_cve_machine	Vulnerabilities set aside on a machine (false positive or fixed): reason, evidence, author.	project_id, cve_id, machine_id, motif, source, preuve, empreinte, empreinte_avis, remediation_id, par, le
conformite_audits	Machine compliance audits: date, score, grade, counters (last 30 per machine).	id, project_id, machine_id, agent_id, tache_id, catalogue, version, empreinte, plateforme, profil, niveau, audite_le, recu_le, duree_ms, score, note, conformes, non_conformes, non_applicables, erreurs, exceptions
conformite_resultats	Result of each compliance rule at the latest audit, with the finding.	audit_id, regle, project_id, machine_id, statut, constat, severite, section
conformite_exceptions	Compliance exceptions: rule, machine, reason, author, expiry.	id, org_id, project_id, regle, machine_id, raison, auteur_id, cree_le, expire_le
conformite_reglages	Compliance settings (level, default profile).	id, org_id, project_id, niveau, profil_defaut, modifie_par, modifie_le

Alerts, cases, exceptions and history

Dataset	Content	Fields
alertes	Alerts, with their history.	id, alert_type, cve_id, watchlist_item_id, project_id, triggered_at, historique
alertes_lues	Alert read state per person.	alert_id, user_id, lue_le
alertes_ecartees	CVEs filtered out by an exclusion rule, with the reason.	id, project_id, cve_id, regle_id, regle_nom, outrepassee, motif, cree_le
regles_exclusion	Exclusion rules.	id, project_id, nom, type, valeur, editeur, auteur_id, cree_le, expire_le
dossiers	Handling cases: status, notes, exception details.	id, project_id, cve_id, status, a_revoir, verification_attendue_le, notes, exception_nature, exception_mesure, exception_justification, exception_echeance, exception_par, exception_le, exception_rappels, exception_jusqu_au_correctif, exception_motif, created_at, updated_at
dossiers_historique	Full status-change history of cases.	id, project_case_id, actor_user_id, from_status, to_status, comment, evenement, created_at
dossiers_commentaires	Case comments.	id, project_case_id, parent_comment_id, author_user_id, body, mentioned_user_ids, created_at
commentaires_lus	Comment read state per person.	comment_id, user_id, lu_le
assignations	CVE assignments.	id, project_id, cve_id, assignee_user_id, assigned_by, assigned_at
etiquettes_cve	Tags applied to CVEs.	id, project_id, cve_id, tag_id, created_by, created_at
echeances	Deadlines set by the team.	id, project_id, cve_id, echeance, posee_par, posee_le
echeances_notifiees	Deadline reminders sent.	id, project_id, cve_id, etape, echeance, notifie_le
remediation_amorces	Deadline tracking start.	project_id, amorce_le, depassees
exceptions	Exceptions register (accepted risks): justification, measures, due date, decision, closure.	id, project_id, cve_id, statut, justification, mesures_compensatoires, echeance_revue, demande_par, demande_le, decide_par, decide_le, motif_decision, auto_approuve, cloture_par, cloture_le, motif_cloture, renouvelle_id, contexte, rappels, created_at, updated_at
traces_notification	Trace of every alert notification sent.	id, project_id, cve_id, canal, evenement, destinataire_user_id, destinataire, statut, detail, reprise, source_ref, cree_le
campagnes_remediation	Remediation campaigns: targeted CVEs, due date, owner.	id, org_id, titre, description, cve_ids, project_ids, echeance, responsable_id, statut, cve_majeure_id, cree_par, cree_le, derniere_verification_le, close_le, close_par
campagnes_cibles	Occurrences tracked by each campaign, their state and the verification evidence.	id, campagne_id, project_id, cve_id, machine_id, machine_nom, composant, version, item_ids, sources, etat, verifiee_le, verifiee_par, preuve, cree_le, maj_le

Compliance, incidents, suppliers and reports

Dataset	Content	Fields
incidents	Incident register.	id, org_id, project_id, annee, numero, reference, titre, description, statut, significatif, qualification, detecte_le, connaissance_le, alerte_precoce_le, notification_le, rapport_intermediaire_le, rapport_final_le, autorite, reference_autorite, impact, cause_suspectee, cause, mesures, ioc, cve_ids, cree_par, clos_le, clos_par, bilan, regime, produit_concerne, correctif_disponible_le, rappels, created_at, updated_at
incidents_journal	Timestamped log of each incident.	id, incident_id, horodatage, rang, auteur_id, auteur_nom, type, texte, donnees
fournisseurs	Supplier register.	id, org_id, nom, nom_normalise, categorie, criticite, statut, source, services_fournis, contact_securite, url_securite, certifications, clauses_securite, notification_incidents, droit_audit, gestion_vulnerabilites, developpement_securise, reversibilite, localisation_donnees, sous_traitants_connus, derniere_evaluation, prochaine_evaluation, resultat_evaluation, notes, cree_par, cree_le, modifie_par, modifie_le, rappels
fournisseurs_alias	Supplier aliases.	id, org_id, fournisseur_id, alias, cree_le
fournisseurs_evaluations	Supplier assessments.	id, fournisseur_id, org_id, evalue_le, resultat, criticite, prochaine_evaluation, questionnaire, commentaire, evalue_par, cree_le
revues_inventaire	Signed inventory reviews.	id, project_id, type, auteur_id, realisee_le, commentaire, nb_elements, controles, resume, empreinte
revues_inventaire_avis	Review reminders sent.	project_id, echeance, notifie_le
rapports	Generated reports, with their data.	id, user_id, project_id, org_id, title, report_type, period_from, period_to, data, generated_at
rapports_conformite	Compliance reports for management, with their data.	id, org_id, periode_debut, periode_fin, langue, genere_le, genere_par, origine, donnees
revues_annuelles	January annual reviews: year, report produced, figures kept, sending date.	id, org_id, annee, report_id, groupe, cree_le, envoyee_le, destinataires

Workflows, notifications and dashboards

Dataset	Content	Fields
destinations_siem	SIEM destinations (syslog, Splunk, Sentinel, Elastic): settings, filters and delivery state; without secrets.	id, org_id, nom, type, config, filtres, actif, dernier_envoi_le, dernier_envoi_nb, total_envoyes, derniere_erreur, derniere_erreur_http, derniere_erreur_le, echecs_consecutifs, cree_par, cree_le, modifie_le
workflows	Workflows: triggers, graph, state.	id, project_id, org_id, name, description, is_enabled, is_default, family, cadre, modele, suspendu, version, graph, created_by, created_at, updated_at
workflows_executions	Workflow runs and their log.	id, workflow_id, user_id, trigger_event, cve_id, status, dedup_key, log, started_at, finished_at
tableaux_de_bord	Organization and project dashboards.	id, name, owner_type, owner_id, project_id, is_default, seed_version, periode_defaut, refonte, composition_precedente, entonnoir, created_at, updated_at
tableaux_widgets	Widgets of these dashboards.	id, dashboard_id, widget_type, title, row_index, slot_index, width, pos_x, pos_y, pos_w, pos_h, config, created_at
tableaux_commentaires	Dashboard period comments.	id, dashboard_id, periode_cle, texte, auteur_id, modifie_le
gels_posture	Frozen weeks of the posture score outcome indicators (year-end freeze, change freeze).	org_id, semaine, motif, pose_par, pose_le

Audit log and exchanges

Dataset	Content	Fields
journal_audit	The organization’s full audit log.	id, actor_user_id, actor_email, action, org_id, target_type, target_id, metadata, ip_address, created_at
support_conversations	Support conversations linked to the organization.	id, user_id, org_id, sujet, statut, dernier_seq_public, lu_utilisateur, cree_le, dernier_message_le, dernier_public_le, ferme_le
support_messages	Messages of these conversations (without the support team’s internal notes).	id, conversation_id, seq_public, auteur_id, cote, texte, cree_le
nps_reponses	Your members’ answers to the in-app satisfaction survey: score, comment, date, call-back follow-up.	id, user_id, org_id, note, commentaire, locale, role, decideur, cree_le, rappel_avant, rappele_le, rappel_statut

Public reference data cited

Dataset	Content	Fields
cves_citees	Records of the CVEs cited by your alerts and cases (public data), for offline reading.	cve_id, state, severity, cvss_score, cvss_vector, cvss_version, epss_score, epss_percentile, cwe_ids, primary_vendor, primary_product, description_en, date_published, date_updated, is_kev, kev_date_added, has_poc

Data not exported

Secrets, keys, tokens and their digests are never exported: they are means of access, to be recreated with the new provider.

• abonnements_push: A person’s devices subscribed to push notifications (browser addresses and encryption keys).
• actions_lots: Short-lived undo snapshots of bulk actions; every status change is in the case history.
• cles_hors_ligne: Private key decrypting offline collections (platform secret).
• cles_passkey: A person’s passkeys: authentication credentials.
• discussion_appareils: Device public keys of the end-to-end encryption.
• discussion_canaux: End-to-end encrypted chat: the service cannot read it; each device keeps its decrypted copy.
• discussion_favoris: Same.
• discussion_journal: Same: end-to-end encrypted messages.
• discussion_lectures: Same.
• discussion_membres: Same: part of the encryption protocol.
• envois_facturation: Technical log of billing emails already sent (prevents duplicates).
• envois_push: Technical sending queue of push notifications; every alert is in the bell and traces_notification.
• evenements_a_traiter: Service incidents (failing connector, failed agent action, quota) shown in a banner: technical state of the banner.
• experiences_expositions: Internal measurement of messages (control group or not, date): aggregated to assess the effect of emails on actions, never on opens; provided on request under the right of access (GDPR, Art. 15).
• expositions_projets: Technical state of the exposure sync.
• identites_externes: Microsoft/Google accounts linked to a person: personal sign-in identifiers.
• match_jobs: Technical computation queue.
• messages_contact: Messages left by visitors on the website contact form, linked to no organization; deleted after 90 days, provided to their author on request (GDPR, Art. 15).
• notification_outbox: Technical sending queue.
• notifications: Personal inbox, purged after 90 days; every alert sent is in traces_notification.
• nps_sollicitations: A person’s preference about the satisfaction survey (postponed, declined).
• oauth_codes: Short-lived authorization codes (access secrets).
• oauth_demandes: Short-lived authorization requests.
• oauth_jetons: Access tokens (access secrets).
• paliers_siem: Technical memory of the last decision tier sent to the SIEM; each case’s tier is recomputed.
• preferences_accessibilite: Personal account preferences (keyboard shortcuts, contrast, motion).
• sante_comptes: Account health score: derived data computed by TechWatchAlert for internal follow-up (aggregates, no automated decision); provided on request under the right of access (GDPR, Art. 15).
• sante_comptes_hebdo: Weekly history of the account health score: same nature, same access.
• usages_liens_triage: Usage counters of one-click triage links (link fingerprints, access secrets); every action is in the case history and the audit log.
• user_source_preferences: Personal account preferences.
• users: Personal accounts: the export includes each member’s email and name (members dataset).