Importing data

Vaultigen imports exports from other password managers into new vaults. Every source uses the same wizard: you upload the export, review how it maps to vaults, folders and tags, decide who gets access, and start the import. Nothing is written before you confirm.

Supported sources

Source	File	Guide
sysPass	Encrypted XML export	Importing from sysPass
KeePass 2.x and KeePassXC	Unencrypted XML export	Importing from KeePass

Before you start

• You need the Super Admin role.
• A queue worker must be running: the import itself runs in the background. There is no synchronous fallback.
• The users and teams you want to give access to should already exist. The import creates no users.
• Check your seat count if you are going to invite everyone afterwards.

The wizard

Open System → Import, choose the source, select the export file and click Stage upload. The export is read once, re-encrypted under a Vaultigen import key and only then reviewed. The source-specific guides explain what you need for the upload.

1. Setup: review what the export contains (counts only, no secret values) and choose a layout: one vault per grouping of the source, or a single vault. For each grouping, choose whether it becomes a separate vault, a folder, a tag, or is skipped. Set the Default Custodian and Default Manager (both default to you) and optionally add users or teams with Viewer, Editor or Manager access to every vault the import creates.
2. Vaults: include or exclude each vault, rename it, and set its Custodian and Manager. An excluded vault is never created and none of its entries are written.
3. Tags: include or exclude each tag and set it to Global or Vault-local. A tag used in more than one created vault defaults to global; existing global tags are reused by name.
4. Confirm and import: enter any password the source still needs and click Run import.

The import never writes into an existing vault.

The report

The Import report shows progress while the queue worker imports, then a summary (“X entries imported into Y vaults; N failed”), the failed entries and attachments with a sanitized reason, and links to the created vaults. You can cancel a running import. Runs that are waiting show a warning when no queue worker has picked them up.

An entry that fails (for example because its title or notes are too long) is skipped and listed; the rest of the import continues. Every created entry goes through the same services as a manual one, so encryption, revisions, grants and the audit log behave identically.

Security properties

• The export is encrypted in staging storage from the first moment. Plaintext exports and passwords are never stored.
• The queue only receives the import ID, never passwords or parsed entries. A password needed by the background job is sealed with the installation key for that run and removed when it ends.
• XML network access, DTDs and entities are disabled, and strict size and depth limits apply.
• Previews, the import history and the report show counts and sanitized reasons only, never secret values.
• New vaults are visible only to the people you assigned.

Retrying and cleanup

There is no resume. To retry from scratch, delete the created vaults and start a new import.

Staged uploads and finished runs are removed automatically after the Import retention period (Settings → Import retention) by the scheduled vaultigen:cleanup-imports command. A run that no queue worker picks up within VAULTIGEN_IMPORT_QUEUE_TIMEOUT (one hour by default) is marked failed and its staged data purged. See Configuration for the import limits.