> ## Documentation Index > Fetch the complete documentation index at: https://docs.dodopayments.com/llms.txt > Use this file to discover all available pages before exploring further. # Request a Card Data Export > Move your customers' saved cards from Dodo Payments to your new PCI DSS Level 1 payment processor in an encrypted export, at the account owner's request. When you move to a new payment processor, we can transfer your customers' saved cards to it, so your customers don't enter their cards again. We send the cards only to a processor that meets the requirements below, in a file that only that processor can decrypt. We export the saved cards and nothing else. You stay in control of your subscriptions: you cancel them on Dodo Payments, you stop sending customers to Dodo Payments checkout, and you choose when your new processor starts charging. We never cancel anything on your behalf. To start an export, see [Request an Export](#request-an-export). ## Requirements Your new processor must meet all of these before we export any card: * **PCI DSS Level 1**: The processor is a PCI DSS Level 1 Service Provider. It sends us its current Attestation of Compliance (AOC), or we find it listed on Visa's Global Registry of Service Providers. We review this before the export. * **PGP public key**: An RSA PGP public key of 4096 bits or more. The processor sends it to us as a file, or serves it over HTTPS on a domain named in its AOC or registry listing. We encrypt the file to this key, and a second person on our team checks its fingerprint against what the processor sent. * **SSH public key**: An `ssh-ed25519` key, or an `ssh-rsa` key of 3072 bits or more. The processor uses it to sign in to our SFTP server and download the file. ## Request an Export 1. **Email [support](mailto:support@dodopayments.com) from the account owner's email address.** We accept a request only from the owner of the Dodo Payments account. 2. **Name your new processor** and give us a contact on its migration team. 3. **Confirm your responsibilities in writing.** We ask you to acknowledge that you cancel your Dodo Payments subscriptions, stop sending customers to Dodo Payments checkout, and time the switch so no customer is charged twice. ## What's Exported The export holds your customers and the saved cards behind their subscriptions, in JSON, in the format most processors already import. Each card appears once, even when several subscriptions use it. ```json expandable theme={null} { "customers": [ { "id": "cus_...", "email": "jenny.rosen@example.com", "name": "Jenny Rosen", "metadata": {}, "default_payment_method": "pm_...", "cards": [ { "id": "pm_...", "number": "4242424242424242", "name": "Jenny Rosen", "exp_month": 1, "exp_year": 2030, "address_line1": "123 Main St.", "address_line2": null, "address_city": "Springfield", "address_state": "MA", "address_zip": "01101", "address_country": "US", "network_transaction_id": "..." } ] } ] } ``` * `id` on a customer is the Dodo Payments customer ID. `id` on a card is the Dodo Payments payment method ID. * `cards` holds every card that one of the customer's subscriptions charges. `default_payment_method` is the `id` of one of them. When a customer's subscriptions use different cards, find each subscription's card by its `payment_method_id` (see [What's Not Exported](#whats-not-exported)). * `network_transaction_id` is included when we hold one for the card. * A missing value is `null`, never an empty string. * **Expired cards are included**, with their real expiry date, so your new processor can refresh them through its card updater. * The file never contains a CVC. We don't store one. ## What's Not Exported | Data | Exported | Notes | | - | - | - | | Saved cards | Yes | Including expired cards | | Apple Pay, Google Pay, UPI, and other non-card payment methods | No | Can't move between processors. These customers add a card at your new processor. | | Subscriptions | No | Read them with [List Subscriptions](/api-reference/subscriptions/get-subscriptions-1) | | Payment history | No | Read it from your dashboard or the API | Each subscription returned by `GET /subscriptions` carries a `payment_method_id`, which is the card's `id` in the export, and a `customer` object whose `customer_id` is the customer's `id` in the export. Use these fields to link each subscription to its card at your new processor. ## How the Transfer Works **1. Request** The account owner emails support and names the new processor. **2. Processor review** We review the processor's AOC or registry listing and check its PGP and SSH public keys. A second person on the Dodo Payments team signs off on the review. **3. Counts before the export** We can share the counts of what will move and what won't, such as how many cards are included, how many of them are expired, and how many customers use a non-card payment method. **4. Approval** A second person on the Dodo Payments team approves every export before it runs. **5. Export** We write the file, encrypt it to the processor's PGP key, sign it with the Dodo Payments export key, and place it on `sftp.dodopayments.com` with a manifest beside it. **6. Download** The processor downloads the file as many times as it needs within 30 days of when we place it on the server. **7. Removal** 30 days after we place the file on the server, it's deleted automatically. ## For Your New Processor Send this section to your new processor's migration team. It covers what they need to download and check the export. 1. **Send us an SSH public key.** We sign in with keys only, not passwords. Send an `ssh-ed25519` key, or an `ssh-rsa` key of 3072 bits or more. Never send the private key. Your SFTP username comes with the hand-over notice, and the account works only while a file is waiting for you. 2. **Check our host key** on the first connection. It must match one of the fingerprints below. 3. **Download the file and its manifest.** Your account can download files but can't upload or delete them. 4. **Check the manifest.** It lists the number of cards, the number of customers, and the SHA-256 digest of the encrypted file. Compare the digest with the file you downloaded before you import it. 5. **Check the signature.** The file is signed with the Dodo Payments export key. Support sends you its public key and fingerprint when we hand over the export. Confirm the fingerprint with us before you trust the key. 6. **Decrypt and import** the file in your own cardholder data environment. | Setting | Value | | - | - | | Host | `sftp.dodopayments.com` | | Port | `22` | | Authentication | SSH public key (`ssh-ed25519`, or `ssh-rsa` of 3072 bits or more) | | Host key (ED25519) | `SHA256:bNVJEIvQDpdVCqGBTNnwg7VQ92zHJAetTgU3yjH4Kzw` | | Host key (RSA) | `SHA256:c6ZtiU/pYkUouo636wygbqy/e0LpCw53l4I3Jwy8lVc` | | File name | `dodo-card-export-.json.gpg` | | Availability | 30 days from when the file is placed, any number of downloads, then deleted automatically | | PCI DSS | Level 1 service provider, [AOC](https://pub-2a89184e4c954b599464449d23f506bb.r2.dev/dodo-payments-pci-dss-aoc.pdf) | Your processor can check the host key before connecting: ```bash theme={null} ssh-keyscan -t ed25519,rsa sftp.dodopayments.com | ssh-keygen -lf - ``` ## After the Export > [!WARNING] > > **Cancel your Dodo Payments subscriptions before your new processor's first charge.** The export doesn't change your subscriptions on Dodo Payments, and we don't cancel them for you. If they stay active, your customers are charged twice: once by Dodo Payments and once by your new processor. > > Cancel each subscription in your dashboard or with [Update Subscription](/api-reference/subscriptions/patch-subscriptions), setting `status` to `cancelled`. Stop sending new customers to Dodo Payments checkout before your new processor starts charging. * You receive a completion summary, including how many of your subscriptions are still active on Dodo Payments, so you can act on them. * You keep access to your dashboard and the API while your account is open. ## Timeline | Phase | When it ends | | - | - | | Processor review and key check | When your processor has sent its AOC and keys. This depends on its response times. | | Counts, approval, and export | Agreed with support once the review is complete | | Download window | 30 days after the file is placed on the server | ## Get Started > **[Contact Support](mailto:support@dodopayments.com)** > > Request a card data export from the account owner's email address. > **[Subscription Migration](/miscellaneous/subscription-migration)** > > Move saved cards and subscriptions from another processor to Dodo Payments. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.