Request a Card Data Export

​

Requirements

• PCI DSS Level 1: The processor is a PCI DSS Level 1 Service Provider. It sends us its current Attestation of Compliance (AOC), or we find it listed on Visa’s Global Registry of Service Providers. We review this before the export.
• PGP public key: An RSA PGP public key of 4096 bits or more. The processor sends it to us as a file, or serves it over HTTPS on a domain named in its AOC or registry listing. We encrypt the file to this key, and a second person on our team checks its fingerprint against what the processor sent.
• SSH public key: An ssh-ed25519 key, or an ssh-rsa key of 3072 bits or more. The processor uses it to sign in to our SFTP server and download the file.

​

Request an Export

1. Email support from the account owner’s email address. We accept a request only from the owner of the Dodo Payments account.
2. Name your new processor and give us a contact on its migration team.
3. Confirm your responsibilities in writing. We ask you to acknowledge that you cancel your Dodo Payments subscriptions, stop sending customers to Dodo Payments checkout, and time the switch so no customer is charged twice.

​

What’s Exported

{
  "customers": [
    {
      "id": "cus_...",
      "email": "jenny.rosen@example.com",
      "name": "Jenny Rosen",
      "metadata": {},
      "default_payment_method": "pm_...",
      "cards": [
        {
          "id": "pm_...",
          "number": "4242424242424242",
          "name": "Jenny Rosen",
          "exp_month": 1,
          "exp_year": 2030,
          "address_line1": "123 Main St.",
          "address_line2": null,
          "address_city": "Springfield",
          "address_state": "MA",
          "address_zip": "01101",
          "address_country": "US",
          "network_transaction_id": "..."
        }
      ]
    }
  ]
}

• id on a customer is the Dodo Payments customer ID. id on a card is the Dodo Payments payment method ID.
• cards holds every card that one of the customer’s subscriptions charges. default_payment_method is the id of one of them. When a customer’s subscriptions use different cards, find each subscription’s card by its payment_method_id (see What’s Not Exported).
• network_transaction_id is included when we hold one for the card.
• A missing value is null, never an empty string.
• Expired cards are included, with their real expiry date, so your new processor can refresh them through its card updater.
• The file never contains a CVC. We don’t store one.

​

What’s Not Exported

​

How the Transfer Works

​

For Your New Processor

1. Send us an SSH public key. We sign in with keys only, not passwords. Send an ssh-ed25519 key, or an ssh-rsa key of 3072 bits or more. Never send the private key. Your SFTP username comes with the hand-over notice, and the account works only while a file is waiting for you.
2. Check our host key on the first connection. It must match one of the fingerprints below.
3. Download the file and its manifest. Your account can download files but can’t upload or delete them.
4. Check the manifest. It lists the number of cards, the number of customers, and the SHA-256 digest of the encrypted file. Compare the digest with the file you downloaded before you import it.
5. Check the signature. The file is signed with the Dodo Payments export key. Support sends you its public key and fingerprint when we hand over the export. Confirm the fingerprint with us before you trust the key.
6. Decrypt and import the file in your own cardholder data environment.

ssh-keyscan -t ed25519,rsa sftp.dodopayments.com | ssh-keygen -lf -

​

After the Export

• You receive a completion summary, including how many of your subscriptions are still active on Dodo Payments, so you can act on them.
• You keep access to your dashboard and the API while your account is open.

​

Timeline

​

Get Started