An Admin can download every secret in the Vault as a spreadsheet inside an encrypted ZIP, so your company never depends on TekStacks to get its secrets back. The ZIP opens only with a key shown once on the page.

Overview

Export on the Vault page makes a ZIP encrypted with AES-256. Inside is vault.csv, one row per secret, for every client, with these columns:

Label, Kind, Client, Username, Secret, Passphrase, Public key or certificate, Expires, Notes and On (the records it is on).

The file is encrypted under a new random key for each export. TekStacks shows that key once, on the page, and never stores it. Every export is recorded, and every Admin is emailed "The Vault was exported" with who did it.

When your company uses its own key, your trusted browser decrypts the secrets and builds the ZIP itself, so TekStacks never sees a value, even during an export.

Config backups are not in the export. Download those one at a time from each device. See Config backups.

Requirements

• Role: Admin (Company settings, custom domain and storage, which only the Admin role has).

Export with TekStacks' key

1. In the sidebar, open Documentation, then Vault.
2. Click Export.
3. If you are asked, enter Your password, to confirm it is you.
4. Click Export. The ZIP downloads.
5. Under The export's key, shown only now, click Copy and save the key in your password manager.
6. Click I saved it.

Export with your own key

1. Open the Vault page in a trusted browser. Export stays grayed out until the browser has opened the vault key.
2. Click Export.
3. If Confirm it is you opens, confirm with your password or a passkey.
4. The ZIP downloads, and the page shows "The export's key, shown only now" with the key. Select it, copy it, and save it in your password manager before leaving the page.

Open the ZIP

Open the ZIP with a tool that reads AES-256 encrypted ZIP files:

• On Windows: 7-Zip.
• On a Mac: Keka, or 7z in Terminal.

Open vault.csv inside it and enter the export's key when asked.

Delete the extracted vault.csv when you are done with it: it holds every secret in plain text.

Notes

Note: The export is the way to move secrets out before turning the Vault off, or before switching to the other key. See Turning on the Vault.

Note: If the email "The Vault was exported" arrives and nobody expected it, turn off that person's account on the Users page and change the secrets.

Troubleshooting

I closed the page before saving the key. The key cannot be shown again. Delete the ZIP and export again: the new file has a new key.

The ZIP tool says the password is wrong. Check the key was copied in full. Each export has its own key, so use the key from the same export as the file.

There is no Export button. Only Admins see it.

FAQ

Is the Vault in the company's data export? No. The data export under Administration never includes secrets. This export is the only way to get them out.

Can we import the file back? No. Add the secrets again from the spreadsheet.