Your data

Everything in your workspace is yours, and you can take all of it with you whenever you want.

How your data is kept

• Backed up every hour. Your workspace's records are copied every hour to storage at a different company from the one that runs the database. Every hourly copy is kept for 7 days, one a day for 30 days, and one a month for 6 months. The backups are checked every day.
• A full download, on every plan. Owners and admins can take everything in the workspace as one .zip. A new one is built every 30 days, and you can download it as often as you like in between. See Full download.
• Deleted on request. Email [email protected] from the address on your account and we delete the account and its data within 30 days of confirming it's you. The owner can also delete it straight away; see Deleting your workspace.

Uploaded files are stored separately from the records. A file you delete is kept for 30 days; see When you delete a file.

Open Company Settings → Your data, which owners and admins can open.

Full download

Download everything makes one .zip with:

• CSV spreadsheets of eight lists: clients, items, quotes, orders, invoices, payments, vendors and purchases, archived and inactive records included. Open them in Excel, Sheets or Numbers, or import them somewhere else.
• JSON records with what a spreadsheet flattens away: line items and their discounts, the tax per rate, shipments and tracking numbers, payments and what each paid, payment schedules, refunds, credit notes and client credit, contacts and addresses, bills of materials, item vendors, production runs, deliveries received, stocktakes, bins and the stock ledger, time entries, signatures, document comments, purchase orders clients sent through the portal, quote templates, email templates, custom fields, your settings, and the activity trail as far back as it's kept (two years by default). One file per kind, in the order they go back in.
• Every uploaded file, as it was uploaded, with an index.json matching each file to its record. Files on clients, quotes, orders and invoices, and your logo, are filed under their record; the rest are in attachments/unfiled/.
• A README and a manifest saying what's in the archive and when it was taken.

Money is written as decimal strings, so nothing is lost to rounding, and dates are ISO 8601 in UTC.

What isn't in it

Some things are left out on purpose, because they're credentials or live connections rather than records of your business:

• Secrets: connected-account tokens and your API keys. An API key is shown once and never leaves the database.
• Webhook endpoints and email settings, which point at other people's systems.
• Recurring invoice schedules and saved cards, which are standing instructions to charge someone. The invoices a schedule has already raised are in the archive; set the schedule up again.
• Client portal accounts, which are other people's logins. A comment or a purchase order a client sent through the portal is in the archive; which portal login sent it isn't.
• Teammates and their permissions, and each person's saved views, columns and dashboard.

How often

A new archive is generated once every 30 days, because building it reads every record and every file. OrderDen keeps it until the next one is available, so if a download drops partway you can take the same file again. Your data shows when it was generated and when the next one is available ("Available now" when there isn't one). The button reads Download again while the kept archive is ready. In between, the main lists export to CSV from their own pages, and the API can read anything at any time. The API's /export endpoint serves the same archive. The kept copy is deleted when the 30 days are up.

Putting it back

The same zip loads back in. Company Settings → Your data → Restore from an archive: choose the file, press Check this archive, and you get a table of what it holds and what it would add, kind by kind, before anything is written. The button that writes appears after that.

The form takes an archive of up to 12 MB, which rules out most archives with files in them. For a bigger one, use the API: POST /api/v1/imports/archive takes up to 512 MB.

It works two ways. Into an empty workspace it rebuilds what the archive holds: the same clients, item numbers, invoice numbers, totals, dates and statuses, the same payments on the same days against the same invoices, the same shelf, and the same hours on the same projects. Your business details aren't restored, because every workspace starts with its own. Into a working workspace it adds what's missing and leaves what's there alone. A record is recognized the way you'd recognize it (a client's name, an invoice's number, a line's place on its document), so nothing is duplicated or overwritten. Loading the same archive twice changes nothing the second time.

Records come back as they were: an invoice keeps its number and total instead of being repriced, and a payment lands on the day the money arrived. Numbering moves to whichever is higher, so a new invoice never reuses a restored number. Settings are only written into a workspace that has none, so a restore won't replace the letterhead you set up this morning.

Sent invoices a restore adds count toward Free's 50, the same as ones you send (see Plans and billing). If the archive holds more than you have left, the check says so and nothing is restored.

Two things are read and deliberately not written back, and the check says so:

• The activity trail. It's a record of what happened in this workspace. The restore writes its own entry saying what it did, and shows in your import history.
• Share links. Restoring one would bring back a link someone was given, and maybe had taken away. Share the document again for a new link.

A restore can't be undone in one press: it writes every kind of record at once. That's what Check this archive is for.

What comes back, and what doesn't

Everything OrderDen exports either imports back or says why it can't:

Why we do this

Plenty of tools make it easy to put your business in and hard to get it out. We'd rather you stayed because OrderDen earns it each month, not because leaving would cost you everything you've typed in. So you can import a spreadsheet on day one, take everything with you any day after, and use the API in between.

Clearing out old files

Attachments grow without anyone deciding they should: photos of purchase orders, scans of delivery notes, receipt pictures. A few years in, they're most of what a workspace stores and almost none of what it looks at.

Company Settings → Your data → Clear out old files removes them in two steps, without touching a record:

1. Pick a date and press See what this would remove. You get the count, the total size and the dates they were uploaded between. Nothing has changed yet.
2. Export and remove. Every file in range is packed into one .zip with a manifest.json saying what each was attached to. The archive is written and read back before anything is deleted. If it can't be written, the clear-out stops and you still have everything.

It includes purchase orders your clients uploaded through the portal. The submission itself, and whether you accepted or declined it, stays.

Only the files go. The client, quote, order, invoice, purchase, expense, project, vendor or portal client PO each was attached to is untouched, with its numbers, its history and its activity trail, which also records the clear-out. Old accounting export files are cleared too.

Two kinds of file are never cleared, whatever date you pick:

• Item photos, which the item's Images tab shows today.
• Your logo, which is on every document you send.

Files in your own Google Drive or Dropbox stay there. A clear-out frees the space OrderDen holds, and a file in your own storage takes none, so only OrderDen's record of it goes. Deleting one attachment yourself is different: it removes the file at the provider too, where its trash holds it. See Storage.

Then delete the archive

Until you do, the clear-out has moved the files rather than removed them: the archive sits in the same storage. Download it, keep it somewhere that isn't OrderDen, then use Delete archive to get the space back.

The archive is kept for 90 days, then deleted for good. That's your window to notice a wrong date and get the files back. After that the clear-out is final, and its row in Past clear-outs reads Archive deleted so you can still see what was removed and when.

The date has to be at least 30 days ago, and one run takes at most 5,000 files or 512 MB, whichever comes first. For a bigger clear-out, start with an early date and run it again for the rest.

How big a file can be

Each upload can be up to 10 MB, and photos are shrunk on the way in to 2,000 pixels on the long edge, which takes a 4 MB phone photo of a page to under half a megabyte with nothing visible lost. The file keeps its name and format. PDFs and anything that isn't a photo are stored as they arrived.

There's also a limit on how many files a workspace uploads in an hour, set far above what a person does, to stop a script in a loop. If a genuine bulk upload hits it, spread it over a few hours.

When you delete a file

A file you delete is kept in OrderDen's storage for 30 days before it's gone for good. You can't open it in that time, and nobody else can. It's there so that if we ever have to restore our database to an earlier point, the records that come back still have their files. Files in your own Google Drive or Dropbox go to that provider's trash instead. Deleting your workspace removes these copies straight away.

The other ways out

• A single list: Export CSV on the Clients, Items, Quotes, Orders, Invoices, Payments, Credit notes, Vendors, Purchases, Inventory and Spending lists downloads what you're looking at, with the columns on screen.
• Reports: every report exports to CSV from its own page.
• The API: GET /api/v1/export returns the same full archive, and ?check=1 says whether one is available yet. Every kind of record has its own endpoints, and /api/v1/attachment-purges runs a clear-out. See the API reference.

Coming in

The importer takes 10 kinds of record from CSV files: your price list, a materials tab, a stock count, last quarter's invoices paid and unpaid, the payments against them, a bank export. It maps your columns, shows you what it read before it writes anything, and undoes a run with one button. A list you exported from OrderDen needs no mapping.

Importing is also how most workspaces end up with the same customer twice, so the Clients list shows a possible duplicates panel that merges them without losing a document.

When support signs in as you

If you ask us for help with something we can't see from outside, an OrderDen support engineer can open your account the way you see it. You'll know:

• We work in a separate system. OrderDen staff have their own logins in their own tool. Nobody at OrderDen has an account in your workspace, and no OrderDen account can be turned into a staff one.
• A banner is pinned to every page for the whole session, saying it's an OrderDen support session and who it's signed in as.
• It ends by itself after an hour, or as soon as the engineer stops.
• It's recorded. Every support sign-in is logged on our side with who did it and when. Ask and we'll tell you.

A support session acts as you, so anything done in it shows in your activity history under your name. A support session can't delete your workspace.

The legal documents

The Terms of Service and the Privacy Policy are linked from the footer of every page. OrderDen is offered only to businesses in the United States.

When you create an account, the version of those documents in force is recorded against your account with the date and time. The two are always issued together and share one version number, shown at the top of each.

When the terms change

• You're emailed. Everyone with a confirmed email address gets one message saying what changed, when it takes effect, and whether anything is needed from you. A change can be announced ahead of time: until its date, the old version still applies, and the top of /terms says a revised version is coming, with a link to read it.
• A minor change needs nothing from you. Wording, typos and clarifications take effect on their date, and carrying on using OrderDen after that accepts them.
• A material change has to be accepted. From its date, the next page you open in the app is a short screen summarizing what changed, with links to both documents. Click I accept and you carry on where you were. Until you do, the app is closed to you, though anything connected through the API keeps working. If you don't agree, sign out; the Privacy Policy says how to have your account closed.
• Every version stays readable. Each document lists all its versions at the bottom, each at its own address (/terms/v/2026-10-07, for example), with what changed since the one before highlighted line by line.

A few things worth knowing without reading either document. Inside OrderDen there are no analytics, no third-party trackers and no advertising technology. The public site (the home page, pricing and these docs) uses Google Analytics to count visits. It's never loaded in the app, the client portal, share links or order forms, and a browser sending Global Privacy Control doesn't load it at all. Where the human check is switched on, it's Cloudflare Turnstile, which sees the visitor's IP address, on the sign-up, resend confirmation, password reset, support and portal sign-in forms. And receipt scanning runs on our own server unless the service is set up with a hosted reader; Company Settings → Receipt reading shows which.

Deleting your workspace

The owner can delete the whole workspace from Account & Billing → Plan & usage → Danger zone → Delete this workspace. Admins and members don't see the button.

Take a copy first. The confirm page links to the full download. Nothing can be recovered afterward, by you or by us.

To go ahead:

1. Type DELETE and the workspace's name, exactly as shown, such as DELETE Fernway Prints. Capitals count. The button stays gray until it matches.
2. Confirm it's you. With a password, enter it, and your authenticator code if you use two-factor authentication. If you only sign in with Google, press Sign in with Google again; you come back to the same page and have ten minutes to finish.
3. Press Delete this workspace permanently.

What happens, all at once:

• Everything in the workspace is deleted: every client, quote, order, invoice, purchase, stock record, uploaded file and activity entry.
• Support requests sent from the workspace are deleted, with our replies and any files you attached to them.
• A paid plan is canceled straight away, with no refund for the rest of the period, and so is a subscription waiting on a failed payment. Your billing details with our payment processor, including any saved card, are deleted too. We keep our record of the payments you made, and the invoices already issued.
• People go with it if this was their only workspace, you included. Anyone in another workspace keeps their login and that workspace, and loses this one only.
• Pending invitations stop working.
• You're signed out and land on the OrderDen home page.

Three things aren't deleted on the spot. Copies in our database backups expire by themselves within six months. Files you kept in your own Google Drive or Dropbox stay there, because they're yours. And we keep a permanent note of the workspace's ID, the date it was deleted and the plan it was on.

There's no API endpoint for this. An API key can't delete the workspace that issued it.

Free workspaces nobody uses

A Free workspace nobody has signed in to or used through the API for 12 months is deleted, after notice. Its owners and admins get an email 30 days ahead giving the date, and a reminder 7 days before. Signing in once cancels it, and so does moving to a paid plan. A client opening an old invoice link doesn't count, and neither do the workspace's scheduled jobs or an OrderDen support session.

Paid workspaces are never deleted for being idle.