Migration & Data Portability

This guide covers exporting your data, migrating to a new infrastructure environment, and import paths when moving from another AI governance tool.

Exporting Your Data

All data stored in BitDrip is owned by your organization and can be exported at any time.

Audit Logs

Export the complete audit log as JSON:

# Full export (all records)
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "http://your-policy-engine:3002/api/v1/audit/export" \
  > audit-export.json

# Date-range export
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "http://your-policy-engine:3002/api/v1/audit/export?from=2026-01-01&to=2026-06-01" \
  > audit-2026-h1.json

Each record in the export includes:

• id — UUID
• timestamp — ISO 8601 UTC
• organizationId
• userId — pseudonymized
• action — block, warn, or log
• riskScore
• contentHash — SHA-256 of the evaluated content
• matchedRules — array of rule IDs and categories
• prevHash — SHA-256 chain link to the previous entry
• hash — SHA-256 of this entry

Policy Configuration

Export all custom rules and compliance profile settings:

# Export policies
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "http://your-policy-engine:3002/api/v1/policies/export" \
  > policies-export.json

# Export compliance profile assignments
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "http://your-policy-engine:3002/api/v1/compliance/export" \
  > compliance-export.json

Users and Organizations

# Export user roster (no password hashes — use for re-provisioning only)
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "http://your-policy-engine:3002/api/v1/admin/users/export" \
  > users-export.json

Full Database Export

For a complete data snapshot including all tables:

pg_dump "$DATABASE_URL" \
  --no-owner \
  --no-privileges \
  --format=custom \
  --compress=9 \
  --file="bitdrip-full-export-$(date +%Y%m%d).pgdump"

See the Database guide for detailed backup and restore procedures.

Migrating to a New Environment

Staging to Production Promotion

To move a tested staging deployment to production:

1. Export the staging database:

   pg_dump "$STAGING_DATABASE_URL" --format=custom > staging.pgdump

2. Set up PostgreSQL and Redis on your production infrastructure

3. Restore to production:

   pg_restore --dbname="$PROD_DATABASE_URL" --no-owner --no-privileges staging.pgdump

4. Copy environment variables — JWT_SECRET, INTERNAL_SERVICE_SECRET, and other secrets must match between your staging export and the services that consume them. See Security Hardening for the full list.

5. Deploy the same image tags that passed staging testing

6. Verify /health returns 200 on all services before switching DNS

Moving to New Infrastructure (VM / Kubernetes)

1. Export your current database (see above)
2. Set up PostgreSQL and Redis on the target infrastructure
3. Restore the database dump to the new PostgreSQL instance
4. Configure environment variables (see Installation and Security Hardening)
5. Deploy the Docker images from GHCR (see Container Registry)
6. Point your DNS records at the new deployment
7. Verify with health checks before decommissioning the old servers

Migrating from Another Tool

If you are moving from a competing AI governance or DLP tool, follow this process to import your existing policies and maintain audit continuity.

Importing Custom Rules

BitDrip's custom rule format:

{
  "rules": [
    {
      "name": "Internal project codes",
      "pattern": "PROJ-[0-9]{4,6}",
      "category": "proprietary",
      "action": "warn",
      "confidence": "medium",
      "message": "Internal project code detected"
    }
  ]
}

Import via API:

curl -s -X POST \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d @rules-import.json \
  "http://your-policy-engine:3002/api/v1/policies/import"

Mapping Rule Actions from Other Tools

Source tool action	BitDrip action
Deny / Block	block
Alert / Warn	warn
Monitor / Audit	log
Allow (explicit)	No rule needed — BitDrip allows by default

Preserving Audit Log Continuity

If you need to import historical audit records from a previous tool for compliance continuity:

1. Export your historical records in JSON format (one object per line, NDJSON preferred)
2. Contact support@bitdrip.app for the audit import utility — historical records are imported with a special flag that marks them as migrated entries and does not include them in the active hash chain (preserving chain integrity)

Uninstalling BitDrip

Before uninstalling, export all data you need to retain:

1. Export audit logs (JSON) — retain per your compliance framework's requirements
2. Export policy configuration — in case you reinstall later
3. Export compliance reports from the Dashboard using CSV or the printable report flow

Then remove the deployment:

# Docker Compose
docker compose down -v   # -v removes volumes and all stored data

WARNING

docker compose down -v permanently deletes all data stored in named volumes. Ensure your exports are complete before running this command.

Data Residency

BitDrip stores data only in the infrastructure you control. You choose where to deploy — on-premises, a cloud provider, a specific region — and data stays there.

No policy evaluation content is sent to Anchor Cyber Security servers. License validation requires an outbound connection to portal.bitdrip.app to verify the license JWT signature, but no content is transmitted.

For EU data residency requirements, deploy BitDrip on EU-based infrastructure and ensure your database and Redis instances are also in the EU region.