Read time: ~7 minutes · Series: Platform Admin (Data Engineering) advanced · Previous: MCP Sources basics
Recommended backup strategy
| Frequency | What to do | Bundle type |
|---|---|---|
| Before delivering an analysis | Export the project with the Plan / Report | Project .lantide |
| Before an environment change | Export the entire workspace | Workspace .lantide |
| Machine swap / offboarding handover | Full backup + confirm the data strategy (Rebind, or a bundle with physical data) | Full backup .lantide |
| Agent personalization migration | Application profile (mind merge/replace) | Application .lantide |
For a full comparison of choosing Project vs Workspace based on sharing an analysis vs continuing work, see USER_GUIDE §11.1.0 and .lantide export/import.
Physical CSV / Parquet:
- Default:
.lantidedoes not include local data files—use NAS/cloud sync or your own backup, and Rebind to the correct directory after import. - Optional: Workspace / Full backup exports let you check Include physical data files to pack registered files into the bundle; sensitive data must be paired with encryption and access control (see passphrase and FAQ below).
Security boundaries (official denylist summary)
Export bundles never include:
license_cache.jsonor license keys- Recoverable database connection passwords (v1 default)
- API keys (Application exports exclude them by default; including keys requires a second confirmation)
Import uses staging + atomic commit; a failure should not leave a half-formed workspace behind. See the data-portability PRD for details.
Optional encryption (passphrase, 0.3.0)
All four export types (Project / Workspace / Application / Full backup) offer an Encrypt bundle checkbox in the Export dialog, which encrypts the outer bundle with a passphrase (at least 8 characters). Left unchecked, it behaves like older versions (a plaintext ZIP with a PK header).
| What you should know | Explanation |
|---|---|
| Why use it | When a bundle will be put in the cloud, emailed, or handed over on a USB drive, it adds a layer of protection for Plan / Report / User Memory and other contents |
| Losing the passphrase | Cannot be recovered—the product cannot decrypt it for you; store it in a password manager or a team key-escrow process |
| Relationship to DB passwords | Encryption protects the .lantide file itself; after import you still need to re-enter the database password in Connections (the denylist is unchanged) |
| Full backup | Only the outer layer is encrypted; the nested inner workspace sub-bundles are still plaintext ZIPs—so the outer passphrase must still be safeguarded |
| Import flow | Choose file → inspect (an encrypted file can first show a low-sensitivity summary) → enter the passphrase to Unlock → full preview → import / Rebind |
| Disk space | Decryption writes a temporary zip and needs extra space; it's cleaned up automatically afterward |
For step-by-step operations, see USER_GUIDE §11.1.4.
When encryption is recommended: bundles containing User Memory, multi-project Plans/Reports, physical data, or a Full backup delivered over an untrusted channel. Transferring within the intranet and importing immediately may skip encryption, subject to team policy.
Post-import checklist (mandatory)
After completing a Workspace / Full backup import, follow the product's prompts:
- Reconnect databases (re-enter passwords)
- Reconfigure MCP sources (if any)
- Run Source Run to rebuild the tab cache (especially important when the bundle does not include physical data)
- Refresh schema (Refresh in the Data title bar)
- Check AI Settings (including localhost-related prompts)
When an analyst reports "the tables are all there but I can't query them"—it's usually stuck at step 1 or 3.
Common issues
| Symptom | Possible cause | Handling |
|---|---|---|
| Local tables missing after import | Wrong Rebind path or files not synced to the new machine | Fix the folder or complete the files, then Refresh; or switch to a bundle with physical data |
| External tables missing | Connection disconnected | Reconnect in Connections + Refresh |
| SQL tab errors | Cache not rebuilt | Source Run |
| Second DB won't connect | Trial allows only 1 active connection | Upgrade or disconnect the old connection |
| Conversation lost after rename | Known limitation in older versions | See the 0.2.3 release known limitations |
| Import prompts for a passphrase | Encryption was checked at export time | Ask the exporter for the passphrase; if lost, it can't be recovered |
| Unlock fails / Incorrect passphrase | Wrong password or a corrupted file | Confirm the case and the complete passphrase (≥8 characters); if it still fails, ask for a re-export |
| Decryption or import is slow | Argon2 derivation + large-file decompression | Normal; make sure the disk has temp space |
| Bundle is very large | Physical data checked or multiple workspaces included | Watch the size hint before exporting; anything over 50 MB requires a second confirmation |
| Extract filename conflict | The target directory already has a file with the same name | In Review files to extract, choose Replace / Rename imported / Keep existing |
| Sharing a bundle leaks sensitive data | Physical data includes business CSVs | Check Encrypt bundle; restrict the download channel and access rights |
| Agent Integration is Exposed, but the Header shows no status | The endpoint is waiting for a client and hasn't established a session yet | Reload the external client's MCP settings and initialize; don't treat Exposed as active |
| An external Agent suddenly can't connect | The connection expired, was Unexposed, Rotated, or Revoked | Check the status in Agent Integration; re-Expose if needed, and update the new token/config to the trusted client |
| Execute / Admin is blocked by another session | A writer already exists in the same workspace | First confirm the blocker and their work; with consent, end the designated session and retry—don't silently preempt |
| The external Agent edited the wrong file | Activity shows that session's content change | If the file hasn't been modified again, use Undo on that Activity card; for conflicts or side-effecting operations, switch to manual repair |
Comparison with manually copying folders
Manually copying workspaces/ is unreliable: absolute paths, connection state, Tab cache, and DuckDB spill easily become inconsistent. Use .lantide + Rebind (or official extract) as the only official migration path.
One thing you can do right now
Paste the five lines of this page's post-import checklist into the team ops wiki, and designate who executes it on a machine swap and who verifies that an analyst can run a SELECT end to end.