# DVE Migration Overview

Migrating to DVE means moving your organization's credentials from another password manager into a fresh DVE vault that is encrypted with **your organization's DVE keys** — not the keys from your old system.

## What migration means for DVE

DVE uses a **zero-existence model**: the DVE backend never holds the keys that decrypt your old vault. It cannot open a 1Password, LastPass, or Bitwarden export on its own.

The migration flow is always:

1. **Export** from your current password manager (usually plaintext CSV, JSON, or a vendor-specific file).
2. **Import** that export into DVE through the import pipeline.
3. DVE **encrypts each credential again** with your org's DVE passphrase and stores opaque ciphertext on the chain.

Your export file is a temporary bridge. Treat it like a list of passwords on your desktop — protect it, import it promptly, then delete it.

## What to expect

| Vault size | Typical import time | Notes |
|------------|--------------------|-------|
| Under 500 items | A few minutes | Most imports finish in one session |
| 500–5,000 items | 10–30 minutes | Large CSV/JSON files take longer to parse |
| 5,000+ items | 30+ minutes | Run during a maintenance window; do not close the browser |

During import, DVE validates each row, maps fields to credential types, and reports warnings for items that need manual review (for example, invalid TOTP secrets or missing names).

## Before you import — checklist

Complete these steps **before** uploading your export:

- [ ] **Disable auto-fill** in your old password manager on shared machines so users are not still saving to the old vault during migration.
- [ ] **Sync or refresh** the old vault so the export reflects the latest passwords.
- [ ] **Export while the vault is unlocked** and your account session is active.
- [ ] **Verify the export file** opens locally and the row/item count looks reasonable.
- [ ] **Store the export on an encrypted disk** only for the short time needed to upload it to DVE.
- [ ] **Plan a cutover window** when users stop using the old manager and start using DVE.

## Choosing the right guide

| You are migrating from… | Start here |
|-------------------------|------------|
| 1Password | [1Password Migration Guide](1password.md) |
| LastPass | [LastPass Migration Guide](lastpass.md) |
| Bitwarden | [Bitwarden Migration Guide](bitwarden.md) |
| Dashlane | [Dashlane Migration Guide](dashlane.md) |
| KeePass / KeePassXC | [KeePass Migration Guide](keepass.md) |
| Another tool or a custom spreadsheet | [Generic CSV Migration Guide](generic-csv.md) |

## DVE field mapping (common concepts)

Regardless of source system, DVE imports map into these credential fields:

| DVE field | Description |
|-----------|-------------|
| `name` | Display name shown in the vault (required) |
| `username` | Login username or email |
| `password` | Secret value for logins |
| `url` | Website or service URL |
| `notes` | Free-text notes |
| `folder` | Folder or group path in DVE |
| `tags` | Labels such as `favorite` |
| `credential_type` | `login`, `secure_note`, `credit_card`, `identity`, or `other` |
| `totp_secret` | Authenticator seed when present |
| `custom_fields` | Additional structured fields not in standard columns |

## Known limitations

- **Attachments** (files stored inside old vault items) are not imported — re-attach files manually in DVE after migration.
- **Shared vault permissions** from the old system are not migrated — re-create sharing and roles in DVE.
- **Password history** from legacy managers is not preserved — only the current password value is imported.
- **Plaintext exports are sensitive** — delete export files after a successful import.

## Post-import verification checklist

After your import job shows **Complete**:

- [ ] Open DVE and spot-check 5–10 high-value credentials (banking, admin consoles, email).
- [ ] Confirm folder structure looks correct for your team.
- [ ] Search for a known site name and verify username/password/URL.
- [ ] Test login on one non-critical site using an imported credential.
- [ ] Review import warnings in the job summary and fix any flagged items.
- [ ] Securely delete the export file from disk and empty the trash/recycle bin.
- [ ] Disable or archive access to the old password manager vault.

## Validation before write

The import system validates **all** records before writing any credentials to the
chain. If any record fails validation, nothing from that batch is committed until
the job completes its validation phase. Failed records are listed in the job
completion summary with the reason for each failure so you can fix the export and
re-run import for those items only.

## Related guides

- [1Password Migration Guide](1password.md)
- [Generic CSV Migration Guide](generic-csv.md)
- [KeePass Migration Guide](keepass.md)