Export and import

A workspace archive is a single file holding everything one workspace owns. It exists so you can move between instances: a self-hosted install to the cloud, the cloud back to self-hosted, or one self-host to another.

Diagnostic participation, shared/rolling limits, restrictive send evidence and audited repair-resolution history travel with their registered mailbox/task/organization data. Source-worker executor handles reset; exact provider-message DKIM authorization/nonces are excluded. Portable minimal receipt proof remains historical evidence, never an execution grant. The reconciliation webhook/notification outbox is source-instance-local and excluded to prevent replay on import; drain pending effects before moving. Whole-instance database backups retain it. See send-safety retention and rollback.

Permanent unknown-warmup retirement markers travel with send history. Imported retired tasks remain cancelled with their outcome recorded as unknown; they never authorize a retry. Use a destination with the compatible retirement schema and recovery code.

Campaign task replay intent resets to unverified on workspace import. The destination cannot replay an imported dead letter as a verified non-sending wakeup. A contact or sequence binding remains restrictive send intent even if that record is later removed. Whole-instance backups retain the durable intent; migration rollback refuses to discard retained send intent or unverified pending campaign dead letters.

Everything here lives under Settings > Data, and is limited to the workspace owner. An export with credentials contains every mailbox password in the workspace, so it sits at the same level as deleting the workspace.

The data is split into groups. Every export includes Workspace; the rest are yours to choose.

Inbox, send history, delivery events, and logs are the ones that grow without limit. Turn them off and you get a small archive that still rebuilds a working workspace; leave them on for a faithful copy.

Click-tracking links travel with Send history, for campaign sends and direct mail alike. Leave the group out and the links already in recipients' inboxes stop resolving on the destination; per-link clicks recorded under Campaigns still arrive, without the link they came through.

The pending warmup-filing queue stays on its source instance. The destination resyncs mail and files recognized warmup messages using its own workers and the mailbox's placement setting.

Campaign contacts waiting for an uncertain send retain that protection with Campaigns, even when you omit Send history. Imported uncertain commands cannot execute again. Without their send history, those contacts stay protected because the destination cannot confirm the original outcome. Manual resume does not remove this protection.

Warmup statistics travel as history. Source-only per-task charge and refund markers reset on import so settling an old task cannot refund another send's destination statistics. Existing destination charge dates and older completed-day counters are protected on overwrite; preserving older counts does not create charge or refund proof. Whole-instance database backups retain these markers.

Mailbox transport-error reports travel as history, retaining every report ID, observation timestamp, task reference and recorded resolution. Their operation and observation provenance reset to unknown, including overwrite imports and older archives without those fields. Imported and legacy historical reports do not share the uniqueness rule for new, locally observed reports and are not automatically cleared by a successful sync or send. Unknown history means recovery is unverified, not that a provider is still failing.

Instance-local transport-success clocks do not travel with an archive. The mailbox transport generation is omitted from exported rows, manifest columns and stored-result/confirmation JSON envelopes; other result and audit evidence remains intact. Importing a new mailbox or overwriting an existing one creates its own destination generation and invalidates only that mailbox's derived transport clocks in the same transaction. Skipped mailboxes and mailboxes not in the archive keep their generation and clocks. This does not clear restrictive send holds, confirmed-task evidence or accounting history.

Send-recovery audit rows also travel as history, including operator confirmations and payload-free contradictory outcome metadata. Source-only rows import without local provenance; an existing destination row with locally recorded provenance is retained on overwrite. A source-instance confirmation cannot become an executable result or release a conflict hold on the destination. Unknown outcomes stay restrictive until independent authoritative worker results or a fresh local administrator/provider confirmation resolves them; importing an archive never authorizes a resend. Legitimate destination-local late results can still settle and apply accounting once. Recovery uses available authoritative results automatically, without a new customer sending or connection step. Only unresolved evidence needs administrator verification, not customer log investigation.

Move recovery history only to a destination with compatible recovery code and schema. An older destination can reject the new conflict evidence type or misinterpret historical confirmations even when it can read the archive. Do not discard audit rows to force an import or downgrade. See conflict-audit upgrade ordering.

Test workspace samples move as ordinary contacts, campaigns and CRM records in their corresponding groups; reply templates are in Assistant. Their instance-wide admin audit marker does not travel, and import does not grant managed Test access.

A restricted member stays restricted on the destination, and each role keeps whether it lets clients act. Their campaign and folder grants travel with Campaigns, so an import without that group brings them in with no campaign access rather than more.

Pick your groups, decide about credentials, and select Start export. The archive builds in the background, so you can leave the page; the Archives list shows live progress and a Download button when it lands.

Archives are kept for 7 days and then deleted automatically. Each one is a full copy of the workspace, so they are not stored indefinitely. You can delete one yourself at any time, and export again whenever you need a fresh copy.

Credentials

Mailbox passwords, OAuth tokens, and integration keys are encrypted with keys that belong to the instance they live on. Those keys mean nothing anywhere else, so credentials cannot simply be copied.

Turn on Include mailbox credentials and SenditCold decrypts them, then re-seals them inside the archive with a key derived from a passphrase you choose. Import that archive with the same passphrase and the destination unseals them and re-encrypts them under its own keys. Mailboxes arrive connected and keep sending.

Leave the option off and the credential fields travel empty. Everything else imports normally, and each mailbox arrives marked for reconnection: open it on the destination and sign in again, exactly like connecting it the first time.

Integrations follow the same rule. Their API keys, OAuth tokens and settings are re-sealed for the destination when the archive carries credentials, and keep working. An integration whose credentials did not come across, because the export ran without them or the source could not decrypt one, arrives marked for reconnection, and the import report names each one by provider and label. A Calendly, Cal.com or Clay connection in that state also stops accepting deliveries at its old inbound URL; reconnect it and give the provider the new URL.

Either way, an SMTP/IMAP mailbox keeps its server certificate choice and the fingerprints it trusts, because they are not secret and describe the same server on any instance.

Webhook signing secrets follow the same rule, including the one an OAuth app signs its deliveries with. Without the option, rotate the app's webhook secret on the destination before relying on its deliveries.

Choose the archive file, enter its passphrase if it has one, and select Check this archive. Nothing is written yet. SenditCold reads the file and reports:

• which workspace it came from, when, and how many rows it holds
• whether your passphrase opens its credentials
• how many rows already exist in the destination workspace
• which members have no account on this instance
• anything in the archive this instance is too old to understand

Then pick the groups to apply, decide what happens to rows that already exist, and confirm.

Rows that already exist

Keep what is here is the default: the archive only adds rows the destination does not already have. This is the right choice for an empty destination workspace, and the safe one for a workspace already in use.

Replace with the archive overwrites matching rows in the destination workspace with the archive's versions. Use it when you are re-running an import to pick up changes made on the source since the last one. It cannot be undone.

Records of another workspace

An import only writes the destination workspace's own records, and everything it brings in points only at that workspace's data. Records keep their identifiers across a move, so an archive holding records that already belong to another workspace on the same instance (for example, one exported from a workspace that still lives there) is refused as a whole and nothing is written. The archive check reports this before you confirm. Import such an archive into the workspace it was exported from, or into a workspace on another instance.

How people are matched

Members are matched to destination accounts by email address, so the same person keeps their campaigns, contacts, and notes. An archive never carries password material and can never create an account.

Anyone in the archive without an account on the destination has their rows reassigned to the person running the import, and the preflight report names them before you commit. Invite them afterwards and they get their access back through the normal member flow.

What deliberately does not import

Cloud connections and mailbox enrollments never travel, including workspace-scoped connections and retained legacy links. That covers whether a mailbox's credential stayed on this server. SenditCold Cloud no longer links new self-hosted instances, so the destination has no Cloud connection: its mailboxes warm locally, or move to a hosted workspace for the hosted pool. Cloud-served redirects arrive served locally with their source connection association cleared.

For a Google Workspace mailbox adopted from Cloud, the domain grant and Cloud warmup history remain on Cloud. Local campaigns, imported messages and local history travel with their selected archive groups. The local mirror has no mailbox credential to export, including when adoption replaced an app-password connection. An archive carries neither Cloud access tokens nor authority to use its domain grant.

When two app-password copies were explicitly associated, the local mailbox still owns its SMTP/IMAP credential. That credential travels if the archive includes credentials, while the Cloud mailbox, its warmup history and the selected Cloud ID on the source enrollment remain on their original instances. No Cloud association or access is transferred by importing the archive.

Some things belong to an instance rather than to a workspace, so they are not applied even when the archive contains them:

An import runs as one transaction. If anything fails, nothing lands and the workspace is untouched.

• Reconnect any mailbox that needs it. Mailboxes without credentials show as needing a reconnect in the mailbox list.
• Point your tracking domain at the new instance. Click links already delivered keep resolving as long as the archive included Send history and the domain follows. Tracking domains on mailboxes and campaigns arrive unverified: the destination re-checks mailbox ones hourly, and a campaign's override is verified again from the campaign's settings. Verifying on the destination also needs its ownership TXT record: the value belongs to the workspace on the instance that issued it, so publish the one the destination shows, at _warmbly.<tracking domain> or once at _warmbly.<domain>.
• Keep the old instance's image host reachable for a while, or re-place the images. The image library and its files travel, but mail already sent carries the old instance's address inside each <img src>, so those images keep loading from there. Bodies you edit after the move pick up the new address.
• Register the destination's callback on your own OAuth apps. On the Partnership plan, the workspace's own Google and Microsoft apps travel, sealed like a mailbox password, so mailboxes they signed in keep refreshing. Exported without credentials, an app arrives without its secret; save it again under Settings > Mailbox sign-in. New sign-ins on the destination need its callback added to each app, unless the app forwards from your own domain. Open sign-in links do not travel; create new ones on the destination. An import into a workspace that already has its own app for the same provider is refused, since a mailbox can only be refreshed by the app that signed it in; remove the destination's app first. If an app forwards its callback from your own domain, point that forwarding at the destination's callback. If its custom redirect points straight at the source instance, clear it or replace it under Settings > Mailbox sign-in, and register the destination's callback on the app. A mailbox whose app arrives without its secret is marked as needing a reconnect until you save it. An archive carrying these apps is written in format version 2, which an instance from before this release refuses, so its mailboxes are never imported without the app that refreshes them.
• Check your inbox vendor connections. Each vendor's API key is sealed with the workspace's own key, so it travels like a mailbox password: in an export with credentials it is re-sealed for the destination and keeps working. Exported without credentials, the connection arrives without its key; edit it and enter the key again. A vendor reconnect's progress stays on the instance that ran it: on the destination a mailbox shows no reconnect yet, and the automatic reconnect treats it as never asked. Which Google permissions a mailbox's sign-in carries travels with its token. A connection made from an account an agency holds carries no key, with or without credentials, because the workspace never held the agency's: it arrives as the workspace's own connection, waiting for a key.
• Make admin grants again. A Google Workspace or Microsoft 365 grant does not travel: it is recorded only after the workspace proves the domain or organization on the instance it runs on, and an archive proves nothing. The mailboxes it connected do travel, but arrive without a grant, so they cannot send or sync until it is made again. On the destination, make the grant again (for Google, the destination's client ID in the Admin console and the proof of the domain; for Microsoft 365, a Global Administrator's consent), then pick those users in the grant's directory, or import a file of their addresses. Each one relinks the mailbox that arrived, with its history and settings, instead of adding a second one.
• Point root redirects at the new instance. A root redirect travels, but it arrives unverified and serves nothing until the destination's own check sees both of its records. The ownership value is issued per workspace and instance, so publish the value the destination lists in the _warmbly TXT record, and update the root's address records. A redirect SenditCold Cloud served for the source instance arrives served by the destination, so its root moves off Cloud the same way. Forwarding set through an inbox vendor lives at the vendor and needs nothing.
• Repoint your forms domain too. A custom forms domain travels with the archive, but its verification does not: the record still points at the old instance. Update the CNAME and publish the ownership TXT value the destination shows, and the hourly re-check picks it up. Until then form links fall back to the shared host rather than breaking.
• Check campaign schedules. Per-contact progress travels, so a running campaign resumes at the step it reached rather than restarting. A campaign's choice to send in each lead's local time travels with it, and the destination works out every contact's location again from the fields that came across, usually within minutes of the import; until it has, region segments on the destination count those contacts as having no location.
• Expect the daily send counters to be honoured. Today's counts come across, so a mailbox cannot double its volume by being migrated mid-day.
• Reconnect each integration the import report names. Those arrived without their credentials and show as needing a reconnect under Integrations. A Salesforce connection syncs nothing until it is reauthorized on the destination; see Salesforce.
• Check inbound URLs. The secret in a Calendly or Cal.com or Clay inbound URL travels only sealed inside an export that carries credentials, and the URL keeps its path on the destination, so give the provider the destination's address. Exported without credentials, the connection arrives marked for reconnection, the import report names it once, and its old URL accepts nothing. Reconnect it and paste the new URL into the provider. An instance on a release from before inbound URLs were sealed imports the archive, but the connection arrives connected with no working inbound URL and the report does not name it. Upgrade that instance before importing, or rotate each inbound URL after.
• Reconnect Slack, then link again. A Slack install belongs to the Slack app of the instance that made it, and Slack sends that app's messages to that instance only. Reconnect under Integrations > Slack on the destination, and each member links their Slack account again (the bot offers a link button the first time they message it). Assistant conversations held in Slack arrive in the dashboard history, where you can continue them.
• Check HubSpot or Pipedrive mode. The mode, its choices and the links between SenditCold and CRM records travel, so the destination keeps updating the same records instead of creating duplicates. Its token only keeps working when the archive carried credentials and the destination uses the same HubSpot or Pipedrive app; otherwise reconnect the CRM there. Writes still queued on the source do not travel, so let sync health (HubSpot, Pipedrive) show nothing pending before exporting. The destination starts its own pull, and in Pipedrive mode registers its own webhooks.
• Rotate each webhook's signing secret. The secret is encrypted at rest with the source instance's key, so it travels only in an export that carries credentials. Exported without them, the endpoint arrives with no secret and its deliveries will not verify at your receiver. Open each endpoint and use Rotate secret, then put the new value in your receiver.

Pending mailbox arrivals and their delivery queue are instance-local. Provider mappings whose arrivals are still pending are excluded too. Let the source consumer finish its pending arrivals before exporting; importing the archive does not replay that source queue. A full-instance backup instead preserves the queue together with its keys and message-body storage.

Provider push channels (a mailbox's Gmail watch or Microsoft Graph subscription) do not travel. Each one delivers to the instance that opened it, so the destination's workers open their own when they load the imported mailboxes, if realtime mailbox sync is set up there. Until then those mailboxes are synced by the regular check.

The Test workspace classification is instance-local. Importing an archive does not classify the destination as Test or grant a managed Test plan or a test balance.

A few things belong to the instance rather than the workspace and are left out on purpose: the instance's link to SenditCold Cloud and which mailboxes it enrolled in the hosted pool (SenditCold Cloud), linked self-hosted instances on a cloud workspace (with the warmup commands queued for them, the warmup mail they reported and how far their placement reports were trusted), Google Workspace and Microsoft 365 admin grants, live sessions, in-flight OAuth handshakes and the organization's wrapped data key. Make each admin grant again after the move. A Cloud link cannot be made again, since SenditCold Cloud no longer links new instances.

Mailbox imports do not travel either, finished or running: an import is work the source instance is doing, and its rows hold credentials in flight. The mailboxes an import connected are ordinary mailboxes and move with the Workspace group, and the saved column mappings come too, so the same file maps itself on the destination. Let a running import finish before exporting: rows it has not connected yet are not in the archive.

Client connect links do not travel. Each one is a live way into the workspace for whoever holds it, and its address names the source instance, so moving it would let a link sent for the source connect mailboxes into the destination. The mailboxes clients connected are ordinary mailboxes and move with the Workspace group. Send new links from the destination.

Contact imports do not travel, finished or running, for the same reason: an import is work the source instance is doing. The contacts it created are ordinary contacts and move with the Contacts group, and the saved column mappings come with them. Let a running import finish before exporting, or the rows it has not reached are not in the archive.

The list of past exports and imports does not travel either. Each job is a record of work the instance that ran it did, and an export's archive lives in that instance's storage until it expires. The destination lists only the exports and imports run there.

A community directory listing does not travel. The OAuth app itself moves with the archive, but its listing is a publication on the source instance, featured or hidden by its team. Publish it again on the destination, where it starts as link only and is featured or not by that instance's team. An app suspended on the source arrives suspended, and so does every app imported into a workspace whose members may not build apps on the destination; the destination's operators decide whether to lift it. An import never clears a suspension the destination already applied. Each app passes the same checks as registering it: a name that breaks the naming rules becomes "Imported app", and a website, redirect URI or webhook address the destination would refuse is dropped. Its logo arrives empty, so upload it again.

Slack account links, the record of which Slack thread belongs to which assistant conversation, and which Slack thread mirrors which inbox conversation in the inbox channel do not travel. They name the Slack install on the source instance, so members link again after Slack is reconnected on the destination, and inbox conversations start new Slack threads there. The assistant conversations themselves move with the Assistant group.

Confirmed websites do not travel. The TXT record that confirms one is bound to the source workspace, so it proves nothing on the destination. Redirects and form redirects to the website arrive kept but not used. The destination shows its own record to publish on each sending domain's Redirect tab, and form redirects to the website work again once it is confirmed there.

Client reports arrive with sharing off and no email schedule. A share link names the source instance's host, and a schedule emails people outside the workspace, so carrying it would send the client every report twice while the workspace exists on both instances. Mint a new link and set the schedule again on the destination, then turn the schedule off on the source. The log of scheduled emails already sent stays behind.

Reply and forward drafts kept in your browser are also excluded. Finish or copy them before moving to another instance. See reply drafts.

• One export and one import can run per workspace at a time.
• An uploaded archive can be up to 8 GB.
• Archives expire 7 days after they finish.
• An archive can be imported into any instance running the same or a newer release. A newer archive on an older instance is refused, with the version in the message.