Users & privacy

A bundle is a downloadable ZIP that people email each other. Archive is built on that assumption, which means some things are excluded by default and some are excluded always.

Never exported, under any setting

• Password hashes. Not with user export on, not with it off, not ever. There is no setting that turns them on.
• Filesystem settings. Filesystems appear in the schema by name and type only. Their settings are where an S3 or Spaces filesystem keeps its access key and secret, and those never leave Craft.
• Craft’s security key and general config. The system section of the schema is a curated, hand-picked set of settings, not a config dump.

Users are off by default

User accounts are excluded entirely until you set Allow user export in the settings. Until then, Users isn’t merely unticked on the export screen — it isn’t offered at all, and the collector reports itself unavailable, so a console command can’t reach it either.

The reasoning is that a bundle full of names, email addresses and login history is a different kind of object from a bundle of blog posts, and turning it into one should be a decision somebody made on purpose.

Addresses follow the same rule

Craft addresses can be owned by a user account or by something else, like an address field on an entry. Archive treats those differently:

• Owned by a user account — held back while user export is off, because a home address attached to a person is personal data whatever element type it’s stored on. Archive warns once when it holds any back, so you know they exist.
• Owned by anything else — travels as ordinary content.

What a user record contains, when enabled

username, email, fullName, firstName, lastName, admin, pending, locked, suspended, lastLoginDate, groups, preferences, photo, plus any custom fields on the user field layout.

Users have no per-site content in Craft, so their records carry no site, siteId or language keys — there’s one record per user, not one per user per site.

Handling a bundle that contains users

Once you’ve enabled it, the bundle is personal data and inherits every obligation that comes with that:

• Restrict who holds the archive:manage permission — that’s who can download bundles. See Permissions.
• Keep bundlePath outside the webroot. The default, @storage/archive/bundles, already is.
• Use retention. Bundles are pruned after 30 days and 20 copies by default; leaving a year of exports on disk is a slow-motion breach.
• Turn the setting back off once the migration is done.

Auditing what actually left

The manifest records the options an export ran with, including whether users were included, and contents gives the count per type. If you need to answer “did that bundle have user data in it” six months later, the bundle answers it itself.